Description
7-Zip before 25.01 does not always properly handle symbolic links during extraction.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
7-Zip 7-Zip
Default version status: unaffected
0 to < 25.01affected
References
- https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b/ ↗
- https://github.com/ip7z/7zip/releases/tag/25.01 ↗
- https://github.com/ip7z/7zip/compare/25.00...25.01 ↗
- https://www.openwall.com/lists/oss-security/2025/08/09/1 ↗
- https://youtu.be/sWT6M1cfnwM ↗
- https://lunbun.dev/blog/cve-2025-55188/ ↗
- https://github.com/lunbun/CVE-2025-55188/ ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-55188-detect-7-zip-vulnerable-version ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-55188-mitigate-7-zip-vulnerability ↗
- http://www.openwall.com/lists/oss-security/2025/10/12/2 ↗
- http://www.openwall.com/lists/oss-security/2025/10/16/7 ↗
- http://www.openwall.com/lists/oss-security/2025/08/09/1 ↗
- http://www.openwall.com/lists/oss-security/2025/08/13/1 ↗
- http://www.openwall.com/lists/oss-security/2025/08/10/1 ↗