Skip to main content
Exploitation reportedNot in CISA KEV yetFix available

CVE-2025-11001

Exploitation reported by one source. First attested on 2025-11-21 by GCVE · kevintel.

  • Published2025-11-19
  • WeaknessCWE-22

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Timeline

dates in UTC
  1. 2025-11-1922:16CVE publishedNVD
  2. 2025-11-2113:46Listed as exploited by GCVEGCVE
  3. 2025-11-2113:46Exploitation first reportedGCVE
  4. 2026-04-08Exploit-DB entryExploit-DB

Versions per branch

NVD
7-zipversion to verify
BranchAffectedFixed in
24.9= 24.09no fix published

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA1 product

As zdi, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • 7-Zipother versions: unknown
    Affected
    • = 24.09 (x64)no fix stated

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2025-11-19

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • 7zipUbuntu:Pro:24.04:LTSall versions · no fixed version listed
  • 7zipUbuntu:Pro:22.04:LTSall versions · no fixed version listed
  • 7zipDebian:14all versions · fixed in 25.00+dfsg-1
  • 7zipDebian:13all versions · fixed in 25.01+dfsg-1~deb13u1
  • 7zipDebian:12all versions · fixed in 22.01+really25.01+dfsg-0+deb12u1
  • p7zipUbuntu:22.04:LTSall versions · no fixed version listed
  • p7zipUbuntu:20.04:LTSall versions · no fixed version listed
  • p7zipUbuntu:18.04:LTSall versions · no fixed version listed

4 more package ranges on OSV.dev

Vendor advisories

  • CVE-2025-11001 Red Hat Product Security

    7zip: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

  • ICSA-26-181-01 CISA1 known affected

    Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M

    Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M: >=1.000A|<=1.014Q

Full record on NVD

Fix

  1. Vendor fix CISA ICSA-26-181-01 · 1 productMitsubishi Electric is releasing fixed version 1.015R or later for MELSOFT Update Manager SW1DND-UDM-M. Please download the update file for the fixed version from the link "https://www.mitsubishielectric.co.jp/fa/download/index.html" (This site is in Japanese) and install it. For more information o…
  2. Mitigation from the vendor CISA ICSA-26-181-01 · 1 productMitsubishi Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:
  3. Mitigation from the vendor CISA ICSA-26-181-01 · 1 productFor users who cannot immediately update the product, Mitsubishi Electric recommends using the PC with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploitation of this vulnerability.
  4. Mitigation from the vendor CISA ICSA-26-181-01 · 1 productFor users who cannot immediately update the product, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), or similar network security controls to prevent unauthorized access and allow only trusted users to remote login when internet access is required, to minimize the ris…
  5. Mitigation from the vendor CISA ICSA-26-181-01 · 1 productFor users who cannot immediately update the product, Mitsubishi Electric recommends restricting physical access to the PC with the affected product and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.
  6. Mitigation from the vendor CISA ICSA-26-181-01 · 1 productFor users who cannot immediately update the product, Mitsubishi Electric recommends preventing users from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Detection

read 2026-11-01 01:02 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
EDB-52501
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
2025-11-19
Last Modified
2026-10-19
NVD status
Analyzed
GitHub Advisory
GHSA-h6cw-8q9x-9gj9

Frequently asked questions

What is CVE-2025-11001?

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Is CVE-2025-11001 actively exploited?

Active exploitation of CVE-2025-11001 has not been confirmed. Its EPSS score was 27.4% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-11001?

CVE-2025-11001 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Running 7zip? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record