A critical vulnerability in 7-Zip, tracked as CVE-2025-11001, is now being actively exploited by threat actors. This flaw, rated CVSS 7.0, affects all versions of 7-Zip prior to 25.00 and could allow attackers to execute arbitrary code on Windows systems. Despite a patch being released in July 2025, many organizations remain exposed due to 7-Zip’s lack of automatic updates and its widespread use in enterprise environments.
What’s the Vulnerability?
The vulnerability stems from how 7-Zip handles symbolic links in ZIP files. Attackers can craft malicious archives that exploit this flaw to perform directory traversal, enabling files to be written outside the intended extraction folder. Under certain conditions—such as when 7-Zip runs under a service account or elevated privileges—this can lead to remote code execution (RCE).
Key technical points:
- Affected Versions: 21.02 through 24.09
- Patched Version: 25.00 (July 2025)
- Exploitation Requirements:
- Windows environment
- Elevated privileges or Developer Mode enabled
- User interaction (extracting a crafted archive)
Why It’s Dangerous
This vulnerability is particularly concerning because:
- Attackers can plant malicious binaries in sensitive directories.
- They can overwrite configuration or startup files, potentially compromising system integrity.
- Exploitation can lead to privilege escalation in environments where automated file processing occurs.
A proof-of-concept exploit is publicly available, which significantly lowers the barrier for attackers. Reports confirm active exploitation in the wild, with sectors such as healthcare, finance, and government already being targeted. This makes timely patching critical.
Discovery and Disclosure
Security researcher Ryota Shiga of GMO Flatt Security discovered CVE-2025-11001 and a related flaw, CVE-2025-11002, both tied to symbolic link mishandling. These were reported in May and patched in July. However, public disclosure occurred in October, leaving a window of vulnerability for months. Since then, attackers have moved quickly to weaponize the flaw.
Additional Related Issues
- CVE-2025-11002: Similar symlink flaw, patched in 25.00
- CVE-2025-55188: Arbitrary file write vulnerability, patched in 25.01
- CVE-2025-0411: Mark-of-the-Web bypass, patched in 24.09
These related vulnerabilities highlight a pattern of issues in archive handling, reinforcing the need for proactive patching and monitoring.
Mitigation Steps
- Update Immediately: Install 7-Zip 25.01 or newer from the official site.
- Restrict Privileges: Avoid running 7-Zip under service accounts or with admin rights.
- Monitor for Indicators: Watch for suspicious ZIP files and symbolic link activity.
- Educate Users: Warn staff about phishing campaigns using malicious archives.
- Audit Systems: Check for outdated versions across all endpoints and servers.
Why This Matters
7-Zip is widely used for file compression and extraction, often outside formal patch management systems. Its lack of auto-update means many endpoints remain vulnerable long after patches are released. This incident serves as a reminder that even trusted tools can become attack vectors when vulnerabilities are left unaddressed.
