Approved changes feed: RSS · Atom
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | 7 Zip (f2c7301d-8512-5d38-84e4-b3faed385a4c) |
|---|---|
| Product | 7 Zip (6f30b4d5-0085-5a75-b16c-95b457d665e4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/han_jin_fei/p7zip |
purl2cpe | 2026-06-01 10:15:10.354106 |
pkg:github/freayd/p7zip |
purl2cpe | 2026-06-01 10:15:10.354111 |
pkg:github/jbdemonte/p7zip |
purl2cpe | 2026-06-01 10:15:10.354115 |
pkg:github/jinfeihan57/p7zip |
purl2cpe | 2026-06-01 10:15:10.354118 |
pkg:github/mcmilk/7-zip |
purl2cpe | 2026-06-01 10:15:10.354122 |
pkg:sourceforge/sevenzip |
purl2cpe | 2026-06-01 10:15:10.354126 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-58052 |
vulnerable | 2026-07-29 01:03:16.598952 |
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
LOW (3.3)
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
Published: 2026-06-28T01:32:54.971Z
Updated: 2026-07-14T20:48:24.263Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55188 |
vulnerable | 2026-06-08 07:33:14.337494 |
Details available
LOW (3.6)
7-Zip before 25.01 does not always properly handle symbolic links during extraction.
Published: 2025-08-08T00:00:00.000Z
Updated: 2025-11-04T22:06:47.049Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53817 |
vulnerable | 2026-06-08 07:31:15.648537 |
GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream
7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.
Published: 2025-07-17T18:12:24.553Z
Updated: 2025-11-04T21:12:38.546Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53816 |
vulnerable | 2026-06-08 07:31:15.647952 |
GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder
7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.
Published: 2025-07-17T18:09:58.480Z
Updated: 2026-05-11T16:53:20.506Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11002 |
vulnerable | 2026-06-08 07:02:27.906803 |
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
HIGH (7)
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26743.
Published: 2026-01-23T02:47:05.205Z
Updated: 2026-02-26T14:44:28.176Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11001 |
vulnerable | 2026-06-08 07:02:27.901948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0411 |
vulnerable | 2026-06-08 07:02:24.538638 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11612 |
vulnerable | 2026-06-08 06:23:49.986057 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11477 |
vulnerable | 2026-06-08 06:23:49.696194 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-52169 |
vulnerable | 2026-06-08 06:17:54.384524 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40481 |
vulnerable | 2026-06-08 06:11:03.323476 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31102 |
vulnerable | 2026-06-08 06:04:41.865124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47112 |
vulnerable | 2026-06-08 05:50:39.855192 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47111 |
vulnerable | 2026-06-08 05:50:39.853686 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29072 |
vulnerable | 2026-06-08 05:42:46.418412 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5996 |
vulnerable | 2026-06-08 05:11:53.201269 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10115 |
vulnerable | 2026-06-08 05:10:26.354387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-17969 |
vulnerable | 2026-06-08 05:09:10.130451 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2334 |
vulnerable | 2026-06-08 05:07:34.149445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-4725 |
vulnerable | 2026-06-08 04:49:57.057202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.