Main Vulnerability Database Vulnerabilities #VU116709

Path traversal in 7-Zip - CVE-2025-11002

Published: October 8, 2025 / Updated: October 24, 2025

Vulnerability identifier: #VU116709

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11002

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the handling of symbolic links in ZIP files. A remote attacker can send a specially crafted HTTP request and upload arbitrary files on the system, leading to arbitrary code execution.

Affected software

7-Zip
Fedora
retroarch

How to mitigate CVE-2025-11002

Install updates from vendor's website.

7-Zip - update to 25.00
retroarch - update to 1.22.0-20.fc44

Links to Public Exploits and PoC-codes

Exploit #12042 - CVE-2025-11001 (October 24, 2025)

External References

https://www.zerodayinitiative.com/advisories/ZDI-25-950/