CVE-2025-55188

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

3.6 LowPublic exploitFix available

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.00%Up 1.0 points since Aug 9, 2025

What each source reports

CVE List Score used 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: CVE-2025-55188
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-59
Updated: 2026-11-02

EUVDEUVD-2025-24018 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: EUVD-2025-24018
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-58pw-r2v4-pwjv 2.7

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: GHSA-58pw-r2v4-pwjv
CVSS 3.1: 2.7 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-59
Updated: 2026-11-02

NVD 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: CVE-2025-55188
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSV 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: CVE-2025-55188
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weakness: CWE-59
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-55188 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: DEBIAN-CVE-2025-55188
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-55188 3.6

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Record: UBUNTU-CVE-2025-55188
CVSS 3.1: 3.6 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

7-zip

Affected packages

Affected packages
Package	Affected	Fixed
`7zip` Debian:12	before 22.01+really25.01+dfsg-0+deb12u1, plus listed versions 22.01+dfsg-10~exp122.01+dfsg-822.01+dfsg-8+deb12u122.01+dfsg-9	22.01+really25.01+dfsg-0+deb12u1
`7zip` Debian:13	before 25.01+dfsg-1~deb13u1, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-1~deb13u1~bpo12+1	25.01+dfsg-1~deb13u1
`7zip` Debian:14	before 25.01+dfsg-1, plus listed versions 24.09+dfsg-825.00+dfsg-125.01+dfsg-1~deb13u125.01+dfsg-1~deb13u1~bpo12+125.01+dfsg-1~deb13u2	25.01+dfsg-1
`p7zip` Debian:12	before 16.02+really25.01+dfsg-0+deb12u1, plus listed versions 16.02+dfsg-8	16.02+really25.01+dfsg-0+deb12u1
`p7zip` Debian:13	before 16.02+transitional.1	16.02+transitional.1
`p7zip` Ubuntu:14.04:LTS	All versions, plus listed versions 9.20.1~dfsg.1-49.20.1~dfsg.1-4+deb7u1build0.14.04.19.20.1~dfsg.1-4+deb7u2build0.14.04.19.20.1~dfsg.1-4+deb7u3build0.14.04.1	None known
`p7zip` Ubuntu:16.04:LTS	All versions, plus listed versions 9.20.1~dfsg.1-4.29.20.1~dfsg.1-4.2ubuntu0.1	None known
`p7zip` Ubuntu:18.04:LTS	All versions, plus listed versions 16.02+dfsg-416.02+dfsg-516.02+dfsg-6	None known
`p7zip` Ubuntu:20.04:LTS	All versions, plus listed versions 16.02+dfsg-716.02+dfsg-7build1	None known
`p7zip` Ubuntu:22.04:LTS	All versions, plus listed versions 16.02+dfsg-8	None known
`7zip` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 21.03~beta+dfsg-621.04~beta+dfsg-121.06+dfsg-121.07+dfsg-121.07+dfsg-221.07+dfsg-321.07+dfsg-421.07+dfsg-4ubuntu0.1~esm1	None known
`7zip` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 23.01+dfsg-323.01+dfsg-723.01+dfsg-823.01+dfsg-1123.01+dfsg-11ubuntu0.1~esm1	None known
`7zip` Ubuntu:25.10	All versions, plus listed versions 24.09+dfsg-724.09+dfsg-825.00+dfsg-125.01+dfsg-125.01+dfsg-2	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	hunters-sec/CVE-2025-55188-7z-exploit	2025-08-11
PoC in GitHub	lunbun/CVE-2025-55188	2025-08-28

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55188 is a low vulnerability (CVSS 3.6) in 7-zip, published August 8, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in 7zip 22.01+really25.01+dfsg-0+deb12u1.

References

Show 13 moreShow less