CVE-2025-11001: 
7-Zip vulnerability analysis and mitigation

CVE-2025-11001 is a directory traversal (path traversal) vulnerability in 7-Zip's ZIP file parsing functionality that allows remote attackers to execute arbitrary code on affected systems. The flaw was reported to the vendor on 2025-05-02, publicly disclosed by the Zero Day Initiative on 2025-10-07 (as ZDI-25-949), and NVD published it on 2025-11-19. It affects 7-Zip version 24.09 and earlier; the fix was introduced in version 25.00. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 7.0 (High) per ZDI (ZDI Advisory, Oracle Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22). When 7-Zip processes a specially crafted ZIP file containing symbolic links, it fails to properly validate or restrict the link targets, allowing the extraction process to traverse outside the intended destination directory. An attacker crafts a ZIP archive with a malicious symbolic link pointing to an arbitrary path; when a victim opens or extracts the archive, 7-Zip follows the symlink and writes files to unintended locations, enabling code execution. Exploitation requires user interaction (opening or extracting the malicious archive) but does not require any privileges. A public technical write-up diffing the patched and vulnerable versions is available (pacbypass blog), and multiple PoC repositories have been published on GitHub (GitHub PoC 1, GitHub PoC 2, GitHub PoC 3).

Successful exploitation allows an attacker to execute arbitrary code in the context of the service account running 7-Zip, resulting in full compromise of confidentiality, integrity, and availability on the affected system. Attackers can write malicious files to arbitrary locations on the filesystem, enabling persistence mechanisms, privilege escalation, or lateral movement within a network. Systems where 7-Zip is used as part of automated pipelines or server-side processing (e.g., file upload handlers, backup services) are at elevated risk, as exploitation may not require direct user interaction in those contexts (ZDI Advisory, Help Net Security).

Active exploitation in the wild has been confirmed, with NHS England issuing a cyber alert warning of ongoing attacks as of November 19, 2025 (NHS Cyber Alert, Help Net Security). Multiple public proof-of-concept exploits are available on GitHub, and an exploit entry has been published on Exploit-DB (EDB-52501). The EPSS score is approximately 0.375%, and the vulnerability is not currently listed in the CISA KEV catalog based on available data. No specific threat actor attribution has been publicly confirmed, though widespread opportunistic exploitation has been reported across multiple sources (Security Affairs, The Hacker News).

1. Reconnaissance: Identify targets using 7-Zip version 24.09 or earlier, particularly systems where ZIP files are automatically processed (e.g., file upload portals, automated extraction pipelines, or end-user workstations).
2. Craft malicious ZIP archive: Create a ZIP file containing a symbolic link that points to an unintended directory (e.g., a startup folder, web root, or scheduled task directory). Tools and PoC scripts for this step are publicly available on GitHub.
3. Deliver the payload: Send the malicious ZIP file to the target via email attachment, file sharing, download link, or any other delivery mechanism that results in the victim opening or extracting the archive with 7-Zip.
4. Trigger extraction: When the victim opens or extracts the ZIP file using 7-Zip ≤24.09, the application follows the embedded symbolic link and writes attacker-controlled content to the traversed path outside the intended extraction directory.
5. Achieve code execution: By writing a malicious executable, script, or DLL to a location that is subsequently executed (e.g., a startup folder, scheduled task, or DLL hijacking path), the attacker achieves code execution in the context of the service account or user running 7-Zip (ZDI Advisory, pacbypass blog, The Hacker News).

• File System: Unexpected files written outside the intended extraction directory after a ZIP extraction operation; symbolic links present within extracted ZIP archives pointing to sensitive system paths; new or modified executables, scripts, or DLLs in startup folders, scheduled task directories, or web roots.
• Process: Unusual child processes spawned by the 7-Zip process (e.g., cmd.exe, powershell.exe, bash, curl, wget) following a ZIP extraction event; 7-Zip process writing files to unexpected locations.
• Logs: Windows Event Logs or Linux audit logs showing file creation events in sensitive directories immediately following 7-Zip extraction; process creation events with 7-Zip as the parent process spawning shells or network tools.
• Network: Outbound connections to unknown or suspicious IP addresses or domains originating from the system shortly after a ZIP file extraction; beaconing behavior from newly dropped executables (NHS Cyber Alert, Security Affairs).

The vulnerability is fixed in 7-Zip version 25.00; all users should update immediately, noting that 7-Zip does not auto-update and requires manual download and installation from the official 7-Zip website (ZDI Advisory). Debian and Fedora have released updated packages for p7zip addressing this vulnerability (Debian Announcement). As a workaround where patching is not immediately possible, restrict user permissions for ZIP extraction operations, avoid extracting ZIP files from untrusted sources, and implement application allowlisting to prevent unauthorized executables from running. Organizations should prioritize patching systems where 7-Zip runs as a service account or in automated pipelines, as these present the highest risk for privilege escalation and lateral movement (Qualys Blog, Oracle Advisory).

NHS England issued a formal cyber alert (CC-4719) on November 19, 2025, warning of active exploitation and urging immediate patching (NHS Cyber Alert). The Hacker News, Security Affairs, Help Net Security, and numerous other outlets covered the active exploitation widely, generating significant community discussion on Reddit (r/SecOpsDaily, r/pwnhub, r/blueteamsec) and Mastodon/Bluesky. Qualys published a blog post emphasizing that the vulnerability highlights the risks of manual patching processes for software like 7-Zip that lacks auto-update functionality (Qualys Blog). Check Point Research included CVE-2025-11001 in its November 24, 2025 threat intelligence report, and Kaspersky's Q4 2025 vulnerability roundup also referenced the flaw (Check Point Research, Securelist Q4 2025).