7-Zip Flaw (CVE-2025-11001) with Public Exploit Code Threatens Unpatched Systems

According to Daily CyberSecurity, researchers disclosed a path-traversal vulnerability in 7-Zip (CVE-2025-11001) that can be triggered when a vulnerable 7-Zip client opens malicious archives, potentially enabling remote code execution. The defect was remedied in 7-Zip v25.00, released about three months ago, with disclosure postponed because 7-Zip lacks an automatic update mechanism, reducing the immediate risk to many unpatched systems.

The write-up of the vulnerability has since been published, and proof-of-concept exploit code has appeared on GitHub, enabling adversaries to weaponise the flaw directly. Users of 7-Zip should upgrade to the latest release promptly, as once a PoC is public, exploitation attempts typically surge exponentially—particularly for software that does not auto-update. Security researchers and practitioners may legitimately use the PoC to test defences and improve future audit and remediation efforts. The article notes the vulnerability and PoC in the context of 7-Zip’s open-source status and the potential impact on unpatched systems.