Recent 7-Zip Vulnerability Exploited in Attacks (CVE-2025-11001)

Du'aine Davis

Observed in the wild

• On 18 November 2025, NHS England issued a cyber alert regarding CVE-2025-11001, a vulnerability in 7-Zip (all versions prior to 25.00). A proof-of-concept (PoC) exploit was publicly released, enabling attackers to abuse symbolic-link handling to write files outside the intended extraction folder, potentially leading to arbitrary code execution. No active exploitation has been observed yet.
• The vulnerability is a File Parsing Directory Traversal Remote Code Execution flaw (CVSS v3 score: 7.0). Attackers can leverage the PoC to manipulate symbolic links during archive extraction, creating opportunities for malicious file placement and code execution. The exploit is currently in the public domain, increasing the likelihood of future attacks.
• Organisations should update 7-Zip to version 25.00 or later immediately. Monitor for suspicious file extraction behaviour, especially symbolic-link abuse. Microsoft Defender users should enable real-time protection and controlled folder access to block unauthorised file writes.

NVD - CVE-2025-11001 CVSS:7.0
Recent 7-Zip Vulnerability Exploited in Attacks - SecurityWeek
Proof-of-Concept Exploit Reported for CVE-2025-11001 in 7-Zip - NHS England Digital