CVE-2025-11002
Directory Traversal in 7-Zip ZIP Parsing Enables Remote Code Execution
Publication date: 2026-01-23
Last updated on: 2026-02-26
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| 7-zip | 7-zip | 24.09 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in 7-Zip involves improper handling of symbolic links in ZIP files, allowing crafted ZIP files to cause directory traversal to unintended locations. When a user interacts with such a malicious ZIP file, an attacker can execute arbitrary code within the context of a service account. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening untrusted or suspicious ZIP files with 7-Zip, especially those received from unverified sources. Ensure that users are aware of the risk of interacting with crafted ZIP files containing symbolic links. Applying updates or patches from 7-Zip when available is recommended to fix the vulnerability. Additionally, restrict user permissions to limit the impact of potential exploitation. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary code on your system with the privileges of a service account, potentially compromising confidentiality, integrity, and availability of your data and system. [1]