{"id":"CVE-2025-11001","published":"2025-11-19T21:16:49Z","modified":"2026-02-26T16:07:46Z","title":"7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability","vendor":"7-Zip","product":"7-Zip","tier":"core","eol":null,"affectedVersions":[{"vendor":"7-Zip","product":"7-Zip","versions":["24.09 (x64)"]}],"description":{"text":"7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.","provenance":"source","from":"CVE.org"},"summary":{"text":"A directory traversal flaw in 7-Zip's ZIP file parsing, specifically in how it handles symbolic links inside ZIP archives, allows crafted archive contents to make extraction write to unintended directories. An attacker who gets a user to open a malicious ZIP file (user interaction required, local access) can execute code in the context of a service account.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:47Z"},"cvss":{"score":7,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.27387,"percentile":0.9806,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-20","exploitedFirstSeen":"2026-01-20","ransomware":false,"evidence":[{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"*Dormant Destruction*                           VirusTotal report                    for index.html","url":"https://otx.alienvault.com/pulse/6a0050a164795207832b4331","created":"2026-05-10"},{"name":"EbeeJan2026 Pt5","url":"https://otx.alienvault.com/pulse/697a9015a6b6986b45485d39","created":"2026-01-28"},{"name":"Fake http://Booking.com ClickFix attack abuses Cloudflare verification to deliver malware","url":"https://otx.alienvault.com/pulse/69766e7c6e7833173d83cb0d","created":"2026-01-25"},{"name":"React2Shell to real-world breach: How an unpatched dev server led to a Windows compromise","url":"https://otx.alienvault.com/pulse/69504fa26af7f91c48029871","created":"2025-12-27"},{"name":"From Armillaria Loader to EDR Killer","url":"https://otx.alienvault.com/pulse/693c89a51f1158f951e33f69","created":"2025-12-12"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-25-949/","tags":["x_research-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-198219","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198219","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52501,"url":"https://www.exploit-db.com/exploits/52501","title":"7-Zip 24.00 - Directory Traversal","type":"local","platform":"multiple","date":"2026-04-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-04-08"},"pocGithub":{"count":5,"skipped":1,"earliest":"2025-10-14","earliestUrl":"https://github.com/shalevo13/Se7enSlip","repos":[{"name":"pacbypass/CVE-2025-11001","url":"https://github.com/pacbypass/CVE-2025-11001","stars":151,"created":"2025-10-15"},{"name":"mbanyamer/CVE-2025-11001---7-Zip","url":"https://github.com/mbanyamer/CVE-2025-11001---7-Zip","stars":7,"created":"2025-11-22"},{"name":"shalevo13/Se7enSlip","url":"https://github.com/shalevo13/Se7enSlip","stars":4,"created":"2025-10-14"},{"name":"lastvocher/7zip-CVE-2025-11001","url":"https://github.com/lastvocher/7zip-CVE-2025-11001","stars":1,"created":"2025-11-20"},{"name":"I3r1h0n/7Ziprowler","url":"https://github.com/I3r1h0n/7Ziprowler","stars":1,"created":"2025-12-12"}]},"first":{"date":"2025-10-14","source":"PoC-in-GitHub","url":"https://github.com/shalevo13/Se7enSlip"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-10-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-04-08","url":"https://github.com/shalevo13/Se7enSlip","provenance":"source"},{"date":"2025-11-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-11001","provenance":"source"},{"date":"2026-01-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 283 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.61,"detail":"percentile 0.9806"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}