Active Exploitation of 7-Zip Symbolic Link Vulnerability (CVE-2025-11001)

Attackers are actively exploiting a critical vulnerability in 7-Zip, identified as CVE-2025-11001, which allows remote code execution through improper handling of symbolic links in ZIP files. The flaw, introduced in 7-Zip version 21.02 and fixed in version 25.00, enables attackers to craft malicious ZIP archives that can traverse directories and execute code in the context of a service account, but only on Windows systems with elevated privileges or Developer Mode enabled. NHS England Digital and multiple security researchers have confirmed active exploitation in the wild, and proof-of-concept exploits have been published, increasing the urgency for organizations to update affected systems.

The vulnerability was discovered by Ryota Shiga of GMO Flatt Security using an AI-powered application security auditor and was publicly disclosed via the Zero Day Initiative. Security advisories emphasize that exploitation is limited to specific Windows configurations, but the presence of public PoC code raises the risk of broader attacks. Users and organizations are strongly advised to upgrade to 7-Zip version 25.00 or later to mitigate the threat and prevent potential compromise from malicious ZIP files leveraging this vulnerability.