{"id":"CVE-2025-55188","aliases":["DEBIAN-CVE-2025-55188","EUVD-2025-24018","GHSA-58pw-r2v4-pwjv","UBUNTU-CVE-2025-55188"],"status":"published","title":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01045,"percentile":0.64582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-59"],"published":"2025-08-08T00:00:00Z","modified":"2026-10-28T10:51:48Z","exploits":[{"source":"pocgithub","id":"hunters-sec/CVE-2025-55188-7z-exploit","title":"hunters-sec/CVE-2025-55188-7z-exploit","date":"2025-08-11","url":"https://github.com/hunters-sec/CVE-2025-55188-7z-exploit"},{"source":"pocgithub","id":"lunbun/CVE-2025-55188","title":"lunbun/CVE-2025-55188","date":"2025-08-28","url":"https://github.com/lunbun/CVE-2025-55188"}],"fixes":[{"ecosystem":"Debian:12","package":"7zip","fixed_in":["22.01+really25.01+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"7zip","fixed_in":["25.01+dfsg-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"7zip","fixed_in":["25.01+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"p7zip","fixed_in":["16.02+really25.01+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"p7zip","fixed_in":["16.02+transitional.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.01+really25.01+dfsg-0+deb12u1"}]}],"versions":["22.01+dfsg-10~exp1","22.01+dfsg-8","22.01+dfsg-8+deb12u1","22.01+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.01+dfsg-1~deb13u1"}]}],"versions":["24.09+dfsg-8","25.00+dfsg-1","25.01+dfsg-1~deb13u1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.01+dfsg-1"}]}],"versions":["24.09+dfsg-8","25.00+dfsg-1","25.01+dfsg-1~deb13u1","25.01+dfsg-1~deb13u1~bpo12+1","25.01+dfsg-1~deb13u2"]},{"source":"osv","ecosystem":"Debian:12","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+really25.01+dfsg-0+deb12u1"}]}],"versions":["16.02+dfsg-8"]},{"source":"osv","ecosystem":"Debian:13","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.02+transitional.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.20.1~dfsg.1-4","9.20.1~dfsg.1-4+deb7u1build0.14.04.1","9.20.1~dfsg.1-4+deb7u2build0.14.04.1","9.20.1~dfsg.1-4+deb7u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.20.1~dfsg.1-4.2","9.20.1~dfsg.1-4.2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.02+dfsg-4","16.02+dfsg-5","16.02+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.02+dfsg-7","16.02+dfsg-7build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"p7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.02+dfsg-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.03~beta+dfsg-6","21.04~beta+dfsg-1","21.06+dfsg-1","21.07+dfsg-1","21.07+dfsg-2","21.07+dfsg-3","21.07+dfsg-4","21.07+dfsg-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.01+dfsg-3","23.01+dfsg-7","23.01+dfsg-8","23.01+dfsg-11","23.01+dfsg-11ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"7zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.09+dfsg-7","24.09+dfsg-8","25.00+dfsg-1","25.01+dfsg-1","25.01+dfsg-2"]}],"products":[{"vendor":"7-zip","product":"7-zip"}],"references":[{"url":"https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b/","tags":["Product","web","report"]},{"url":"https://github.com/ip7z/7zip/releases/tag/25.01","tags":["Release Notes","web","report"]},{"url":"https://github.com/ip7z/7zip/compare/25.00...25.01","tags":["Product","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/08/09/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://youtu.be/sWT6M1cfnwM","tags":["Exploit","web"]},{"url":"https://lunbun.dev/blog/cve-2025-55188/","tags":["Exploit","Third Party Advisory","article"]},{"url":"https://github.com/lunbun/CVE-2025-55188/","tags":["Exploit","web"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-55188-detect-7-zip-vulnerable-version","tags":["web"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-55188-mitigate-7-zip-vulnerability","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/12/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/16/7","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/09/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/13/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/10/1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55188","tags":["advisory"]},{"url":"https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b"},{"url":"https://lunbun.dev/blog/cve-2025-55188"},{"url":"https://github.com/lunbun/CVE-2025-55188"},{"url":"https://github.com/advisories/GHSA-58pw-r2v4-pwjv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55188.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-55188","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-55188","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55188","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-55188","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2025-11-04T22:06:47.049Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-24018","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2025-11-04T22:06:47Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-58pw-r2v4-pwjv","title":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T21:30:40Z","modified":"2025-11-05T00:32:30Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-55188","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T21:15:25.89Z","modified":"2026-06-17T09:41:25.473Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:11:22.319351Z"}],"osv":[{"id":"CVE-2025-55188","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2026-10-28T10:51:48.100301488Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-55188","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T21:15:25.89Z","modified":"2026-09-01T20:04:23.992582143Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-55188","description":"7-Zip before 25.01 does not always properly handle symbolic links during extraction.","status":"published","published":"2025-08-08T21:15:00Z","modified":"2026-01-20T19:04:24.985365Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:50.817402Z"}]}}