CVE-2025-11001

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 27.39%
EPSS Percentile: 98.05%
CISA KEV: Not listed

Description

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: zdi-disclosures@trendmicro.com
Published: 20-Nov-2025 05:16
Last Modified: 19-Oct-2026 20:10
EPSS Date: 2026-10-20
CWE: CWE-22

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

7-zip / 7-zip
Version / affected range: 24.09
cpe:2.3:a:7-zip:7-zip:24.09:*:*:*:*:*:*:*

References

zdi-disclosures@trendmicro.com

Last enrichment sync: 21-Oct-2026 15:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

### 4. 7-Zip Symbolic-Link Vulnerabilities (CVE-2025-11001 & 11002) Seqrite’s India Cyber Threat Report 2026 Records 265.52 Million Detections
CVE-2026-2441 vulnerability (CVSS 8.8 High) and the 7-Zip CVE-2025-11001 vulnerability (CVSS 7.8 High) were Picus Blue Report 2026 Finds Enterprise Defenses Block Just 37% of Post-Compromise Actions

CVE (22)

Malware (20)

People (5)

Threat Actors (20)

MITRE ATT&CK (30)

Vendors (2)

Products (27)

Tools (9)

Industries (20)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.