CRITICAL 7 ZIP VULNERABILITY WITH PUBLIC EXPLOIT REQUIRES MANUAL UPDATE

Summary from the TLDR InfoSec newsletter

CVE-2025-11001 is a directory traversal RCE flaw (CVSS 7.0) in 7-Zip's symbolic link handling that allows arbitrary code execution when users extract malicious ZIP files. A public PoC exploit is available, and Microsoft is tracking active weaponization. It was fixed in version 25.00, but 7-Zip lacks auto-update capability, leaving widespread unpatched installations. Inventory all Windows systems with 7-Zip versions below 25.01 and immediately push updates via Intune or deployment scripts.