7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

Successful exploitation of CVE-2025-11002 allows an attacker to execute arbitrary code on the target system with the privileges of the user running 7-Zip. This could lead to complete system compromise, data theft, or the installation of malware. The symbolic link traversal vulnerability is particularly concerning as it bypasses normal file access controls. The attack vector involves crafting a specially designed ZIP archive containing symbolic links that point outside the intended extraction directory. This allows the attacker to write files to arbitrary locations on the system, potentially overwriting critical system files or injecting malicious code. Similar directory traversal vulnerabilities have historically been exploited to gain persistent access to systems.

Systems utilizing 7-Zip version 24.09 (x64) are at risk, particularly those where 7-Zip is used to process ZIP files from untrusted sources. Shared hosting environments and systems with automated archive processing workflows are especially vulnerable due to the increased likelihood of exposure to malicious ZIP files.

• windows / supply-chain:

Get-Process -Name 7z | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.Action.Exe -like "7z*"}

• windows / supply-chain:

reg query "HKCU\Software\7-Zip" /v Path

• generic web: Inspect 7-Zip installation directories for unexpected files or modifications.

1. 2026-01-23Disclosure

   disclosure

1. Reserviert2025-09-25
2. Veröffentlicht2026-01-23
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-11002 is to upgrade to a patched version of 7-Zip as soon as it becomes available. Until a patch is released, consider restricting the ability to extract ZIP files from untrusted sources. Implement strict file access controls to limit the potential impact of a successful exploit. Consider using a Web Application Firewall (WAF) or proxy to inspect incoming ZIP files for suspicious symbolic links or unusual file paths. Monitor system logs for unusual file creation or modification activity in unexpected directories. While a direct detection signature is difficult, monitor for processes spawning from 7-Zip with unusual command-line arguments.