What’s the vulnerability? • The flaw is tracked as CVE‑2025‑11001, a remote code execution (RCE) in the widely-used file archiver 7‑Zip.  • It results from improper handling of symbolic links inside ZIP archives, allowing directory-traversal so that files may be written outside the expected extraction directory.  • Attackers can thereby overwrite critical system files or inject malicious payloads and achieve arbitrary code execution under the context of the user or service running 7-Zip.  ⸻ W

Lab: File path traversal, validation of file extension with null byte bypass | Web Security Academy

What is path traversal, and how to prevent it? | Web Security Academy