支持本站 — 捐款将帮助我们持续运营

目标：1000 元，已筹：752 元

75.2%
立即捐款

POC详情： a89fcb97478c8e4c93a32370eca514d3dd041b74

来源
https://github.com/B1ack4sh/Blackash-CVE-2025-11001
关联漏洞
标题：7-Zip 路径遍历漏洞 (CVE-2025-11001)
描述：7-Zip是7-Zip开源的一个压缩软件。 7-Zip存在路径遍历漏洞，该漏洞源于处理ZIP文件中的符号链接不当，可能导致远程代码执行。
描述
CVE-2025-11001
介绍
# 🔥 **CVE-2025-11001: Critical 7-Zip RCE Vulnerability** 🔥

![_7-Zip RCE Vulnerability Actively Exploited by Hackers (1)](https://github.com/user-attachments/assets/7b2f6076-4c4e-480a-a519-73322c701ff6)

⚠️ **Severity**: Critical (Remote Code Execution)  
🛠️ **Affected**: 7-Zip < 25.00 (Windows + Linux p7zip)  
🧨 **Exploit Type**: Malicious ZIP → Directory Traversal + RCE  
🔗 **CWE**: CWE-22 (Path Traversal)  
🕵️‍♂️ **Public Exploit**: Yes, already circulating  
📅 **Disclosed**: October 7, 2025  

### 🎯 How It Works  
Attackers craft a booby-trapped .zip file containing `../../evil.exe` or similar paths. When you extract it with vulnerable 7-Zip → bam! Files are written anywhere on the system → instant code execution. 💥 

### 🧨 Usage:

```
python3 CVE-2025-11001.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe
```

### 🖥️ Affected Platforms (as of Nov 2025)  
| Platform       | Status                  | Emoji Verdict      |
|----------------|-------------------------|--------------------|
| Windows 7-Zip  | < 25.00 → Vulnerable    | ❌ Patch NOW!      |
| Debian p7zip   | Still unpatched         | 😱 Danger zone     |
| Ubuntu         | Partial fixes           | ⚠️ Update ASAP     |
| 7-Zip ≥ 25.00  | Fixed                   | ✅ Safe            |

### 🛡️ Immediate Fix  
🚀 **Download 7-Zip 25.00+** → https://github.com/ip7z/7zip/releases/tag/25.00  
🔍 Scan with Nessus (plugin 270234)  
🏖️ Extract unknown ZIPs only in sandbox  

Don’t be the next victim — patch today and stay safe out there! 🛡️✨
文件快照

 [4.0K]  /data/pocs/a89fcb97478c8e4c93a32370eca514d3dd041b74
├── [2.3K]  CVE-2025-11001.py
└── [1.6K]  README.md

1 directory, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。