Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability (CVE-2025-11001)

A security flaw in 7-Zip, tracked as CVE-2025-11001, is being actively exploited in the wild, according to an advisory issued by NHS England Digital. The vulnerability, which has a CVSS score of 7.0, allows remote attackers to execute arbitrary code and was addressed in 7-Zip version 25.00, released in July 2025.

The flaw lies in how symbolic links are handled in ZIP files, with crafted data potentially causing the process to traverse to unintended directories and run code in the context of a service account, per ZDI’s alert quoted in the report. The 7-Zip 25.00 release also fixes another flaw, CVE-2025-11002, which likewise relates to symbolic links in ZIP archives and directory traversal, and both flaws were introduced in version 21.02.

Ryota Shiga of GMO Flatt Security Inc., together with the AI-powered AppSec Auditor Takumi, are credited with discovering and reporting the vulnerability. There are proof-of-concept exploits publicly available, and NHS England Digital urged users to apply the fixes promptly for optimal protection. Security researcher Dominik (pacbypass) noted that exploitation is possible only from an elevated user or service account context and specifically on Windows.