Vulnerability Report

CVE-2025-11002

RCE

Title: Directory Traversal to RCE in 7-Zip

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2025-11002

CWE Category CWE-22

Published Date Jan 23, 2026

Modified Date Feb 26, 2026

Exploit Status Available

Score 7.8 CVSS v3.0

Exploit Probability (EPSS)

0.52%

Vulnerability Summary

CVE-2025-11002: 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.

Impacted Vendors

igor_pavlov 1

7-zip 1

Reference Links

https://www.zerodayinitiative.com/advisories/ZDI-25-950/

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.0

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-11002 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/pacbypass/CVE-2025-11001

View Code

February 26, 2026 MODIFIED

Vulnerability data updated via NVD.

February 26, 2026 MODIFIED

Vulnerability data updated via NVD.

January 26, 2026 MODIFIED

Vulnerability data updated via NVD.

January 23, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector LOCAL

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.