Skip to content
Appaloosa Scout

Vulnerability · NVD

CVE-2025-11002

HIGH 7.8

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.

Attack vector : Local No privileges required
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS 0.52% exploit very unlikely percentile 41.3%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

  • 7-Zip Windows winget:7zip.7zip
    Affected — Fixed in — Latest tracked 26.02 undetermined
Vulnerable CPE configurations (1)
Vendor Product Versions
7-zip 7-zip
All platforms (wildcard)
 —
View on NVD ↗