lastvocher/7zip-cve-2025-11001Python exploit for CVE-2025-11001 targeting 7-Zip on Windows, leveraging symlink creation to achieve code execution when 7-Zip runs with Admin privileges.
python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe
The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be succesfully exploited. This is because it the 7-zip process creates a symlink, which is a privileged operation on windows.
Hence the exploitation only makes sense when 7-Zip is used by a service account.
You can find more info about the vulnerability in my blog post https://pacbypass.github.io/2025/10/16/diffing-7zip-for-cve-2025-11001.html
Vulnerable versions: 21.02 - 25.00