CVE-2025-11001

unknown

Published — · Modified —

CVSS v3

—

CVSS v2

—

VIR risk

1.0

Description

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Predictions

Exploit likelihood

55%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2025-11001.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2025-11001

Exploits

Exploit-DB

EDB-52501 · local · multiple

OS impact

OS	Version	Status	Fixed in
debian	sid	fixed	`25.00+dfsg-1`
debian	bookworm	fixed	`22.01+really25.01+dfsg-0+deb12u1`
debian	trixie	fixed	`25.01+dfsg-1~deb13u1`
debian	forky	fixed	`25.00+dfsg-1`
sles		affected
debian	bullseye	fixed	`16.02+really25.01+dfsg-0+deb11u1`

References

Verify integrity in audit chain (admin only). AS-IS.