7-Zip Mark-of-the-Web Bypass Vulnerability - CVE-2025-0411
Summary
CVE-2025-0411: 7-Zip Mark-of-the-Web Bypass Vulnerability. Affects 7zip versions 22.01+dfsg-10~exp1 – 24.09+dfsg-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
7-Zip is a popular open-source file archiver that supports numerous archive formats, providing high compression ratios and a user-friendly interface. It is widely used for compressing and decompressing files, making it a staple in both personal and professional environments. However, a vulnerability has been identified that allows attackers to bypass the Mark-of-the-Web protection mechanism, potentially leading to unauthorized code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2025-0411, exists within the handling of archived files in 7-Zip. When extracting files from a crafted archive that includes the Mark-of-the-Web, 7-Zip fails to propagate this security marker to the extracted files. This oversight allows attackers to execute arbitrary code in the context of the current user, provided they can lure the user into visiting a malicious page or opening a compromised file. The flaw is particularly concerning as it can lead to significant security breaches if exploited.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid extracting files from untrusted archives or ensure that they are using a secure environment when handling such files. Additionally, users can manually check the properties of extracted files to ensure they are not executing any unauthorized code.
Conclusion
The 7-Zip Mark-of-the-Web Bypass Vulnerability (CVE-2025-0411) poses a significant risk by allowing attackers to execute arbitrary code through a flaw in the handling of archived files. Users are strongly advised to update their software to the latest patched versions to mitigate this risk and ensure their systems remain secure.
See every vulnerability recorded for 7zip →
FAQ
The Mark-of-the-Web is a security feature in Windows that helps protect users from potentially harmful files downloaded from the internet by marking them with a specific attribute.
If you are using versions of 7-Zip prior to 24.09+dfsg-1 for Debian 13 or prior to 16.02+transitional.1 for p7zip on Debian 13, your version is affected by this vulnerability.
If immediate updates are not possible, avoid extracting files from untrusted sources and consider using a different archiving tool until the vulnerability is addressed.
Yes, Vulert can monitor your software for open-source vulnerabilities in real-time using just a manifest file like package-lock.json, without requiring installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for 7zip.
