Two 7-Zip Flaws Allow Code Execution via Malicious ZIP Files (CVE-2025-11001 & CVE-2025-11002)

Two critical vulnerabilities in 7-Zip, CVE-2025-11001 and CVE-2025-11002, could allow attackers to execute arbitrary code by tricking users into opening specially crafted ZIP files, with patches issued in version 25.00. The flaws arise from improper handling of symbolic links inside ZIP archives, permitting a malicious ZIP file to traverse outside the intended extraction directory and potentially overwrite or execute files.

Exploitation requires some user interaction, such as opening or extracting a malicious archive, though attack vectors may vary for embedded or server-side deployments using 7-Zip libraries. Directory traversal in archive tools can have serious consequences in enterprise environments, including the risk of code execution if overwritten files are executed later by the system or a privileged service.

The ZDI advisory notes that remote attackers could trigger arbitrary code “in the context of a service account.” While standalone users must manually open a file, automated workflows could be exploited more covertly, underscoring the need to update to 7-Zip 25.00 to mitigate the risk, according to the ZDI advisory.