CVE-2025-11001: NHS Warns of PoC Exploit for 7-Zip Symbolic Link–Based RCE Vulnerability

Summary

Defenders disclosed a remote code execution vulnerability in 7-Zip (CVE-2025-11001), triggered by specially crafted ZIP archives containing symbolic links. NHS England Digital released an advisory noting the availability of proof-of-concept (PoC) exploit code, while emphasizing that no confirmed in-the-wild exploitation had been detected at that time. The issue primarily impacts Windows environments and can be abused by adversaries who gain access to a service account. A subsequent advisory update clarified that, despite initial concerns, active exploitation had not been observed.

CVE-2025-11001 Analysis

Researchers determined that CVE-2025-11001 stems from a path traversal flaw in how 7-Zip processes symbolic links embedded in ZIP files. Trend Micro’s Zero Day Initiative underlined the potential impact, and a security researcher published a PoC showing practical code execution via the bug. NHS England Digital tracked telemetry for any signs of exploitation and issued guidance informed by these research findings and threat-intel reports.

Mitigation

To mitigate risk, users should upgrade to 7-Zip version 25.00, which addresses both CVE-2025-11001 and CVE-2025-11002. Organizations should prioritize this update on systems where 7-Zip runs with elevated privileges or developer tooling. Additional hardening measures include blocking execution of untrusted archives, limiting who can run 7-Zip on sensitive hosts, and monitoring for unusual process behavior related to archive handling.

Response

Detection and response teams should watch for 7-Zip processes launched from untrusted paths and for anomalous symbolic link creation in temporary or user-writable directories. Generate alerts when high-privilege processes originate from 7-Zip activity and correlate these signals with Windows Event Logs to spot potential code execution attempts. Ensure the latest 7-Zip patch is deployed and reinforce least privilege execution policies across endpoints.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary crafts a malicious archive named “7‑Zip 21.02_exploit.zip” that contains a symbolic link pointing to C:\Windows\System32\calc.exe. When the victim extracts the archive with a vulnerable 7‑Zip version (21.02), the symbolic link is resolved, causing the attacker‑controlled payload to be written to a privileged location and subsequently executed, achieving remote code execution via CVE‑2025‑11001.

  Steps performed on the attacker’s workstation (simulated locally):

  1. Create a symbolic link link_to_calc that points to C:\Windows\System32\calc.exe.
  2. Package the symlink into a ZIP file whose name includes the exact string “7‑Zip 21.02”.
  3. Drop the ZIP onto the target host (simulated by copying to a monitored folder).

• Regression Test Script: The following PowerShell script reproduces the above actions on the target machine. It assumes the current user has rights to create symbolic links (SeCreateSymbolicLinkPrivilege).

  # Simulation script – creates a malicious ZIP that should fire the Sigma rule
  # Prerequisite: Run as Administrator to create a symlink
  
  # 1. Define paths
  $tempDir   = "$env:Temp\ziptp"
  $linkPath  = "$tempDir\link_to_calc"
  $targetExe = "$env:WINDIR\System32\calc.exe"
  $zipPath   = "$tempDir\7-Zip 21.02_exploit.zip"
  
  # 2. Prepare working directory
  New-Item -ItemType Directory -Force -Path $tempDir | Out-Null
  
  # 3. Create symbolic link (file type)
  cmd /c mklink "$linkPath" "$targetExe" | Out-Null
  
  # 4. Verify link creation
  if (-not (Test-Path $linkPath -PathType Leaf)) {
      Write-Error "Failed to create symbolic link."
      exit 1
  }
  
  # 5. Add the symlink to a ZIP archive using 7‑Zip (assumes 7z.exe is in PATH)
  & 7z a -tzip -slink "$zipPath" "$linkPath" | Out-Null
  
  # 6. Clean up the temporary link (keep the ZIP for detection)
  Remove-Item $linkPath -Force
  
  Write-Host "Malicious ZIP created at $zipPath"

• Cleanup Commands: Remove the artifact after verification.

  $tempDir = "$env:Temp\ziptp"
  Remove-Item -Recurse -Force $tempDir
  Write-Host "Cleanup complete."