CVE-2025-55188

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Affected

7-Zip

CVSS v3.1 MITRE

3.6 LOWCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

EPSS

1.00% chance of exploitation in the next 30 days, 62nd percentile

Published

2025-08-08

Updated

2025-11-04

Proof-of-concept exploits (3)

• https://lunbun.dev/blog/cve-2025-55188/
• hunters-sec/CVE-2025-55188-7z-exploit32★ · 2025-08-11
• lunbun/CVE-2025-5518810★ · 2026-05-04

Security advisories

• https://lunbun.dev/blog/cve-2025-55188
• https://www.openwall.com/lists/oss-security/2025/08/09/1
• ip7z/7zip/releases/tag/25.01
• https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b

References

• CVE Record
• NVD entry

Related

• CVE-2025-31200
• CVE-2025-43300
• CVE-2025-11001