A critical flaw in 7-Zip is now under active attack as threat actors use crafted ZIP files to gain remote code execution on Windows systems. The vulnerability, tracked as CVE-2025-11001, lets attackers escape extraction folders and place malicious files on a victim’s machine. Security teams have confirmed live exploitation after a public proof of concept lowered the barrier for abuse. Millions of users are at risk until systems are updated to 7-Zip version 25.00 or later.
Relevant Source (NHS England Digital): Active Exploitation Reported for CVE-2025-11001 in 7-Zip
NHS England Digital confirms that CVE-2025-11001 is a directory traversal RCE in 7-Zip, is being actively exploited, and advises immediate updates to version 25.00 or later, directly supporting the risks and remediation described in this article.
Quick Facts
- CVE-2025-11001 allows remote code execution through ZIP symbolic link abuse
- Root cause involves improper path handling during ZIP extraction
- PoC exploit is public, and attackers are already using it
- Affected versions span 21.02 through all releases before 25.00
- Version 25.00 fixes this flaw and the related CVE-2025-11002
- NHS England Digital issued an alert confirming active exploitation
How The 7-Zip RCE Bug Works
The 7-Zip RCE vulnerability is a directory traversal flaw that triggers when the program processes ZIP files containing malicious symbolic links. These links can force 7-Zip to write files outside the intended extraction path which lets attackers overwrite system files or deliver payloads that run with the user’s permissions. Trend Micro’s Zero Day Initiative showed how this method can also bypass sandbox limits during automated file handling in enterprise workflows.
- Exploits use crafted symbolic links in ZIP archives
- Attackers can overwrite key files during extraction
- Minimal user action is needed to trigger the attack
The weakness impacts Windows builds of 7-Zip that date back to version 21.02. The update to version 25.00 blocks symbolic links from escaping their paths which prevents malicious writes.
Relevant Source (Trend Micro Zero Day Initiative): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
This advisory details how crafted ZIP archives with symbolic links can traverse out of the extraction directory and execute code, confirming the directory traversal and RCE behavior fixed in 7-Zip 25.00.
Relevant Source (SecurityWeek): Recent 7-Zip Vulnerability Exploited in Attacks
This article explains how threat actors are abusing a 7-Zip symbolic link handling flaw affecting versions 21.02–24.09 to overwrite files and achieve remote code execution and notes that version 25.00+ addresses the issue.
Why This 7-Zip Flaw Matters
This flaw opens the door to full remote code execution on systems that rely on 7-Zip for routine extraction and automated processing. The impact is higher because many organizations use 7-Zip for bulk workflows that run without human oversight. NHS England Digital confirmed active exploitation which shows the threat is not theoretical. Attackers can deliver ransomware or plant persistent backdoors through a single ZIP file.
- RCE allows attackers to run code on the victim’s machine
- Phishing and drive by downloads spread the malicious ZIP files
- Sectors with high file volume such as healthcare are prime targets
- Automated extraction pipelines can silently spread malware
- The public PoC makes exploitation easier for low skill actors
Keeping systems updated is the only reliable way to block this threat. Older versions remain exposed even if users avoid suspicious files.
Relevant Source (NHS England Digital): Proof-of-Concept Exploit Reported for CVE-2025-11001 in 7-Zip
This cyber alert explains how CVE-2025-11001 in 7-Zip can lead to remote code execution via symbolic link abuse and urges organizations to update, underscoring the real-world impact of the flaw.
Relevant Source (CISA): #StopRansomware: Akira Ransomware
This joint CISA advisory shows how ransomware groups use tools like 7-Zip in data theft and extortion campaigns, reinforcing why 7-Zip vulnerabilities can quickly translate into high-impact ransomware incidents.
How To Fix Your 7-Zip Risk
All Windows systems using 7-Zip should update to version 25.00 or later as soon as possible. The fixed version adds stronger path checks that prevent symbolic links from escaping their folders. Organizations should verify that automated workflows and shared systems use the updated build.
Steps to take now:
- Update 7-Zip to version 25.00 from the official site
- Remove older builds to avoid accidental use
- Recheck automated or scripted extraction tools
- Alert staff about malicious ZIP files in phishing attempts
The update fully neutralizes both CVE-2025-11001 and CVE-2025-11002 and closes the path traversal issue.
Relevant Source (7-Zip Project): 7-Zip 25.01 Release Notes
This official release page confirms that 7-Zip 25.x changes symbolic link handling to improve security when extracting archives, backing the recommendation to upgrade from older vulnerable builds.
Relevant Source (Trend Micro Zero Day Initiative): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
This ZDI advisory describes the directory traversal RCE flaw in 7-Zip and explicitly notes that the vulnerability is fixed in version 25.00, supporting the guidance to update and remove older versions.
Wider Impact On 7-Zip Security
Directory traversal flaws in file archivers tend to have long tails because many users run outdated tools for years. 7-Zip is widely used in business environments which increases the risk of one vulnerable workstation affecting many others. Attackers know this and often target compression utilities to gain silent entry into networks.
The release of a working proof of concept always accelerates abuse. Once that code becomes public, threat actors fold it into phishing campaigns and automated scanners. Early evidence shows active targeting of healthcare and finance where daily file handling is heavy.
Relevant Source (Tom’s Hardware): New 7-Zip High-Severity Vulnerabilities Expose Systems to Remote Attackers — Users Should Update to Version 25 ASAP
This report explains how 7-Zip’s RCE bugs threaten a broad installed base and stresses that lack of automatic updates leads to long-term exposure, illustrating the long-tail risk of outdated archivers.
Final Thoughts On 7-Zip RCE
Users who run older versions of 7-Zip face real exposure as threat actors launch new attacks using malicious ZIP files. Updating to version 25.00 is the fastest and most effective defense. Systems that rely on bulk or automated extraction routines should receive special attention because they offer attackers broad reach with little effort.
FAQ
Is this flaw being actively exploited now
Yes. Security teams and NHS England Digital confirmed live attacks.
Which versions of 7-Zip are vulnerable
All Windows versions from 21.02 up through releases before 25.00.
Does opening a ZIP file trigger the attack
Extraction of a crafted archive can trigger the exploit with little user action.
Are Linux or macOS builds affected
No issues have been confirmed for those platforms as of now.
Does the latest update fix both linked CVEs
Yes. Version 25.00 resolves CVE-2025-11001 and CVE-2025-11002.
How JENI Strengthens System Safety
JENI gives Windows users a cleaner and more stable environment that reduces the risk surface attackers look for when exploiting tools like 7-Zip. Systems that stay updated, streamlined, and free of leftover file clutter are harder to penetrate in routine phishing or file handling workflows. JENI supports this by improving reliability and reducing the weak points that often appear in unmanaged systems.
Key Advantages
- Removes leftover temp files that attackers often abuse
- Helps maintain a stable environment that reduces crash-prone behavior
- Supports cleaner workflows for users who handle large volumes of files
JENI reinforces good security hygiene by keeping systems running in a predictable state where surprise failures are less common. A cleaner platform gives users a better chance of spotting suspicious files before they cause trouble. Strong maintenance also helps prevent the stack of minor issues that often hide early signs of compromise. Tools like 7-Zip remain safer when the underlying system is stable and well maintained.
