CVE-2025-11001

Vendor7-zipProduct7-zipDiscoveredNov 19, 2025UpdatedNov 24, 2025

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

View graph Watch Export

CVSS v3.1

7.8 HIGH

EPSS

27.4%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 22, 2026

▲ 0.39pp

27.0% → 27.4% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorLOCAL

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Connections

4 relationships

CWE-22

source

Timeline

disclosure → media coverage

Nov 19, 2025

helpnetsecurity.com reports: 7-Zip vulnerability is being actively exploited, NHS England warns (CVE-2025-11001)

Nov 19, 2025

thehackernews.com reports: Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability (CVE-2025-11001)

Nov 19, 2025

Disclosure — published as a CVE record. · last revised by NVD Nov 24, 2025

Public PoC (6)

github.com/shalevo13/Se7enSlip github.com/pacbypass/CVE-2025-11001 github.com/lastvocher/7zip-CVE-2025-11001 github.com/mbanyamer/CVE-2025-11001---7-Zip github.com/ranasen-rat/CVE-2025-11001 github.com/I3r1h0n/7Ziprowler

Unverified third-party code — review before executing.