Re: CVE-2025-55188: 7-Zip: Arbitrary file write on extraction, may lead to code execution

[Jens-Wolfhard Schicke-Uffmann <drahflow () gmx de>]

On Sun, Aug 10, 2025 at 05:04:24PM -0700, lunbun wrote:
> If a symlink targets a nonexistent directory, the write will fail. 7-Zip by
> default will print an error message, like:
> ```
> ERROR: Cannot open output file : errno=2 : No such file or directory : ./
> malicious_link/file.txt
> ```
>
> This applies similarly to other filesystem errors, like insufficient
> permissions or unwritable directory.
>
> However, 7-Zip by default continues with extraction regardless of the error,
> which is why an attacker can use this "shotgun" strategy. These errors, though,
> would hopefully help notify the user that something suspicious is happening.
Never forget terminal escape codes. At least the 7-Zip my debian
has dumps the raw filename in those error messages. This allows an attacker
to clean the specific error lines after they have been output (with
another, later filename containing the required escapes).

With some fantasy, it might also be possible to massage the overwrite
prompts (they're also unescaped) into suggesting to choose "(A)lways",
e.g. by good cursor movement and setting a scroll region far above for
the real prompt.


Regards,
  Drahflow

Attachment: signature.asc
Description: