Log in Start free

Vulnerability · Published Jan 23, 2026 · Assigned by zdi

CVE-2025-110027-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

High 7.0

In plain English

A high-severity path traversal in 7-Zip from 7-Zip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.0High
Exploit odds (30 days)0.5%top 54.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:127zip22.01+really25.01+dfsg-0+deb12u1DEBIAN-CVE-2025-11002
Debian:137zip25.01+dfsg-1~deb13u1DEBIAN-CVE-2025-11002
Debian:147zip25.00+dfsg-1DEBIAN-CVE-2025-11002
Debian:12p7zip16.02+really25.01+dfsg-0+deb12u1DEBIAN-CVE-2025-11002
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2025-11002
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2025-11002

Affected products (as reported)

VendorProductVersions
7-Zip 7-Zip 24.09 (x64)

Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References