CVE-2025-11002: 7-Zip Directory Traversal RCE Vulnerability

CVE-2025-11002 Overview

CVE-2025-11002 is a directory traversal vulnerability in 7-Zip that allows remote attackers to execute arbitrary code on affected installations. The flaw exists in how 7-Zip handles symbolic links inside ZIP archives. Crafted entries can cause the extraction process to traverse outside the intended directory and write files to attacker-chosen locations. Successful exploitation requires the victim to open or extract a malicious archive, after which code may run in the context of a service account. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-26743 and is tracked as [CWE-22] Path Traversal.

Critical Impact
Attackers who deliver a crafted ZIP file can drop and execute arbitrary code in the context of a 7-Zip service account, leading to full compromise of confidentiality, integrity, and availability on the host.

Affected Products

7-Zip version 24.09
Windows, Linux, and macOS builds of 7-Zip that share the affected ZIP parsing code
Third-party applications that bundle the vulnerable 7-Zip library for archive handling

Discovery Timeline

2026-01-23 - CVE-2025-11002 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2025-11002

Vulnerability Analysis

The vulnerability resides in 7-Zip's ZIP file parser, specifically in the handling of symbolic link entries. ZIP archives can contain entries marked as symbolic links, where the entry data describes a link target path. During extraction, 7-Zip fails to fully validate that the resolved target stays within the destination directory. An attacker can craft a ZIP archive whose symlink entries reference parent directories using .. sequences or absolute paths. When the archive is extracted, subsequent entries follow the malicious link and write files to unintended locations on the file system.

Writing files outside the extraction directory enables several code execution paths. An attacker can drop a binary into a directory referenced by PATH, overwrite a script executed at logon, or replace a DLL loaded by a privileged service. Because 7-Zip is frequently invoked by service accounts for automated archive processing, the dropped payload often executes with elevated privileges rather than those of the interactive user.

Root Cause

The root cause is insufficient canonicalization and validation of symbolic link targets contained in ZIP entries [CWE-22]. The extractor processes link entries before verifying that their resolved paths remain inside the user-specified output directory, allowing traversal through ../ segments or absolute paths embedded in the archive metadata.

Attack Vector

Exploitation requires user interaction. A victim must open, extract, or otherwise process a malicious ZIP file using a vulnerable build of 7-Zip. Delivery vectors include phishing email attachments, drive-by downloads, software supply chain artifacts, and automated extraction pipelines that ingest untrusted archives. The attack complexity is low and no privileges are required from the attacker, but successful code execution depends on the security context in which 7-Zip is executed.

The vulnerability is described in prose only because no public proof-of-concept code is available. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-950.

Detection Methods for CVE-2025-11002

Indicators of Compromise

ZIP archives containing entries with symbolic link attributes whose targets include .. traversal sequences or absolute paths
Files written by 7z.exe, 7zG.exe, or 7zFM.exe outside the user-selected extraction directory
Unexpected creation or modification of executables, DLLs, or scripts in system directories shortly after a 7-Zip process executes
New scheduled tasks, services, or autorun entries created in the same process tree as a 7-Zip extraction

Detection Strategies

Inspect ZIP archives at email and web gateways for symlink entries that resolve outside the archive root
Hunt for 7-Zip processes writing files to paths such as C:\Windows\System32, Program Files, startup folders, or service binary locations
Correlate parent-child process relationships where 7-Zip is followed by execution of newly written binaries
Monitor for 7-Zip invocations running under service accounts that extract archives sourced from network shares or download directories

Monitoring Recommendations

Enable file integrity monitoring on system directories, startup folders, and service binary paths
Log command-line arguments for all 7-Zip executions and retain them for retrospective hunting
Audit write operations performed by archive utilities and alert on writes outside expected extraction roots

How to Mitigate CVE-2025-11002

Immediate Actions Required

Inventory all systems running 7-Zip 24.09 and any applications that bundle the 7-Zip library
Upgrade to a 7-Zip release that addresses the symbolic link traversal flaw as soon as a fixed version is available
Restrict automated extraction services so they run with the minimum privileges required and not as high-privilege service accounts
Block or quarantine inbound ZIP archives from untrusted sources at email and web filtering layers

Patch Information

At the time of NVD publication, refer to the Zero Day Initiative Advisory ZDI-25-950 for vendor remediation status. Apply the fixed 7-Zip release from the official project as soon as it is published, and update any third-party software that ships the vulnerable parser.

Workarounds

Disable symbolic link extraction in 7-Zip configurations where the option is available
Extract untrusted archives only inside sandboxed or container environments with no write access to sensitive paths
Use application allowlisting to prevent execution of binaries written into unexpected directories by archive utilities
Train users to avoid opening archives from unverified senders and to scan archives before extraction

bash

# Example: extract untrusted archives inside a restricted directory and reject symlink entries
mkdir -p /tmp/sandbox-extract
chmod 700 /tmp/sandbox-extract
7z x -snl untrusted.zip -o/tmp/sandbox-extract
# -snl tells 7-Zip to store symbolic links as plain files instead of resolving them