A proof-of-concept exploit for two critical vulnerabilities in the popular file archiver 7-Zip, potentially allowing attackers to execute arbitrary code remotely through malicious ZIP files.

The flaws, tracked as CVE-2025-11001 and CVE-2025-11002, were disclosed by the Zero Day Initiative (ZDI) on October 7, 2025, and stem from improper handling of symbolic links during ZIP extraction on Windows systems.

Both carry a CVSS v3.0 score of 7.0, highlighting their potential for serious impact despite initial perceptions of lower risk.

These issues affect 7-Zip versions from 21.02 up to 24.09, where flaws in the symlink conversion process enable path traversal attacks. Discovered by Ryota Shiga of GMO Flatt Security Inc., the vulnerabilities exploit how 7-Zip processes Linux-style symlinks, converting them to Windows equivalents without adequate safeguards.

In a detailed analysis shared by security expert pacbypass, the bugs arise in the ArchiveExtractCallback.cpp module, particularly in functions like IsSafePath and CLinkLevelsInfo::Parse.

Unpacking the Symlink Flaws

The core problem lies in 7-Zip’s extraction logic, which fails to properly validate symlink targets. When extracting a ZIP containing a Linux symlink pointing to a Windows absolute path like C:\Users, the software misclassifies it as relative due to a flawed absolute path check tailored for Linux or WSL environments.

This bypasses safety checks in IsSafePath, allowing the symlink to resolve outside the extraction directory.

Further, during symlink creation in SetFromLinkPath, 7-Zip prepends the extraction folder path to the target, crafting a seemingly safe relative path that evades validation.

A subsequent check in CloseReparseAndFile skips directory-specific scrutiny for non-directories, enabling the symlink to point arbitrarily. Patches in version 25.00 introduce a new IsSafePath overload with an isWSL flag and refined parsing to detect absolute paths correctly, closing these gaps.

The analysis draws from diffs between versions 24.09 and 25.00 on GitHub, revealing a rework of symlink support. While one CVE likely targets direct path traversal, the other involves UNC path symlinks, amplifying risks in networked scenarios.

Exploiting these flaws requires crafting a ZIP where a symlink extracts first, redirecting subsequent files to sensitive locations like the Desktop or system directories.

For instance, a malicious archive could create a symlink named “link” pointing to C:\Users$$Username]\Desktop, followed by a payload like calc.exe. Upon extraction, 7-Zip follows the link, writing the executable to the target, potentially leading to code execution if the user runs it.

The PoC, available on pacbypass’s GitHub repository, demonstrates this by unpacking a directory structure that dereferences the symlink, enabling arbitrary file writes.

However, exploitation demands elevated privileges, developer mode, or an elevated service context, limiting it to targeted attacks rather than broad phishing. It works solely on Windows, ignoring Linux or macOS.

Mitigations

Users should update to 7-Zip 25.00 immediately, as it addresses these issues comprehensively. Disabling symlink support during extraction or scanning archives with antivirus tools can reduce exposure. These vulnerabilities underscore ongoing risks in archive handlers, echoing past 7-Zip flaws like directory traversals.

With the PoC public, attackers may weaponize these for initial access in phishing campaigns. Organizations relying on 7-Zip for bulk extractions should audit workflows and monitor for anomalous file writes.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post PoC Exploit Released for 7-Zip Vulnerabilities that Let Attackers Execute Arbitrary Code Remotely appeared first on Cyber Security News.

A newly disclosed Server-Side Request Forgery (SSRF) flaw in Zimbra Collaboration Suite has raised major security concerns, prompting administrators to patch systems immediately.

The issue, identified in the chat proxy configuration component, could allow attackers to gain unauthorized access to internal resources and sensitive user data.

According to Zimbra’s latest advisory, this critical SSRF vulnerability affects Zimbra versions 10.1.5 through 10.1.11. Malicious actors could exploit the issue by manipulating URL requests to make the server perform unintended actions, such as accessing restricted endpoints or internal systems.

Although the deployment risk is categorized as low, the security severity is classified as high due to the potential data exposure and privilege abuse.

The vulnerability stems from improper validation in the chat proxy configuration module, which could enable crafted requests to route through Zimbra’s internal network.

This vector might allow attackers to retrieve configuration files, tokens, or other sensitive data stored in connected services, posing a significant privacy risk for enterprise users who rely on Zimbra for email and collaboration.

Mitigations

Zimbra has released version 10.1.12, which patches the SSRF flaw and introduces several performance stability updates. Administrators are strongly advised to review the Zimbra 10.1.12 Release Notes and deploy the newest update as soon as possible to prevent exploitation.

Security teams should also verify system integrity following patch installation and monitor access logs for any suspicious or unauthorized internal requests that might indicate prior compromise.

Applying the latest update not only mitigates this SSRF threat but also enhances Zimbra’s overall resilience and performance.

Regular patch maintenance, combined with proper configuration hardening, remains the best defense against evolving threat vectors targeting enterprise collaboration platforms.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Critical Zimbra SSRF Vulnerability Let Attackers Access Sensitive Data appeared first on Cyber Security News.