Setup guide · Last reviewed 10 November 2026

Opening an archive safely: the extractor is part of your attack surface

ZIP and RAR files are how files arrive, and also how a lot of bad files arrive. What 2025's 7-Zip advisories changed, and a routine that costs ten seconds.

Almost nobody thinks of a compression tool as security software. It sits there quietly opening whatever arrives, from a project handover to an invoice someone emailed, which is exactly why it belongs in a conversation about staying safe on a new machine. It parses complex file formats written by strangers, and it usually runs with your full user rights.

In 2025, two 7-Zip advisories made that concrete. This page uses them to explain a routine rather than to scare anyone: extract into a fresh folder, check where the files land, and keep the tool current. We name the disclosures and link to the primary reports; we do not reproduce exploit code or invent version numbers.

Why an archive tool gets security advisories at all

An archive is a miniature filesystem. It can contain paths, links, unusual names and nested formats, and the extractor has to decide where each item belongs on your real disk. The safe rule is simple: nothing inside the archive should ever determine a destination outside the folder you chose. Most of the serious bugs in this category are variations on breaking that rule.

That is a different problem from a malicious program inside the archive. Even a perfectly implemented extractor will happily unpack a harmful executable; it is a delivery mechanism, not a filter. So the two risks need two different habits: keep the extractor patched, and treat its output as untrusted.

• The extractor parses paths and links, not just compressed bytes.
• It normally runs with your user rights, so a bug can write wherever you can write.
• A clean archive can still contain a harmful file. Extraction is not scanning.

The tools this step calls for, with their real licence and platform details:

What the 2025 advisories actually said

Trend Micro's Zero Day Initiative published two advisories, ZDI-25-949 and ZDI-25-950, covering CVE-2025-11001 and CVE-2025-11002. Both describe the same underlying weakness: crafted symbolic links inside a ZIP archive could make the extraction process traverse to an unintended directory, with code execution in the context of the account running the tool. Both were fixed in 7-Zip 25.00. Later reporting from heise online noted a further symbolic-link correction in 25.01.

The operational detail matters more here than the CVSS number: 7-Zip does not check for updates by itself. A version installed during a machine rebuild in 2023 could still be there in 2026 unless somebody looked. That is why we link the publisher's version history from the tool page, and why 'keep it updated' is useless advice without telling people how.

• Check Help, then About, then compare against the current release on the publisher's site.
• Follow the version history rather than a news summary when you need to know what a release fixed.
• The advisories describe Windows-specific exploitation conditions; the underlying lesson about parsing untrusted input is not platform-specific.

A ten-second extraction routine

Create a new empty folder and extract into that, rather than into Downloads or onto the Desktop. Afterwards, look at the folder tree. If you see a path that climbs upward, an unexpected hidden directory, or an executable sitting next to the document you were expecting, stop and work out what it is before opening anything.

Never run an executable directly from inside the archive viewer. Extract first, then decide. That one step is what makes directory traversal visible: a file that would have landed somewhere else now sits in a folder you can actually inspect. It also gives an on-demand scanner a real file to look at instead of a stream inside a viewer.

• Extract to a new empty folder, not into a directory that already has files in it.
• Read the extracted tree before double-clicking anything.
• If the archive came in an unexpected email, the correct move is often not to open it at all.

The tools this step calls for, with their real licence and platform details:

Check the file before it reaches the extractor

Source first. An installer or ISO from the publisher's own domain is a different proposition from a 'driver pack' found through a search ad. Where the publisher publishes a checksum, compare it; the Windows ISO guidance from Microsoft is a good example of the habit, and our page on checking official downloads walks through it in plain steps.

Second, notice the context. Archives disguised as invoices, CVs or courier notices are a standard way to get someone to bypass their own caution, precisely because opening a ZIP feels routine. If you were not expecting the file, the cost of asking the sender is a message; the cost of being wrong is a reinstall.

The tools this step calls for, with their real licence and platform details:

Mistakes to avoid

• Assuming a free utility with no update prompt is automatically the current version.
• Double-clicking an executable straight from the archive viewer because it is quicker.
• Extracting into Downloads, where new files are indistinguishable from old ones.
• Running an archive tool as an administrator for convenience, which widens what a bug can reach.
• Treating a scan of the archive wrapper as a scan of everything inside it.

Questions people ask

Should I stop using 7-Zip?

No. The disclosures describe bugs that were fixed. The reasonable response is to confirm you are on a current build, which we explain on the tool page.

Does the built-in Windows extractor avoid this?

It handles fewer formats and exposes fewer options, but it is still parsing untrusted input. The extract-to-a-folder habit applies either way.

How do I know which version I have?

Open the application and use Help, then About, then compare it with the version listed on the publisher's site. There is no automatic update check to do it for you.

Is RAR safer than ZIP?

The format is not the point. Path handling, link handling and how current your extractor is matter more than the extension on the file.

Related guides

• Checking a download
• Avoiding bundled installers
• Antivirus decision
• Reinstall checklist

Or see all guides and category explainers.

Sources and further reading

These are the published sources this guide leans on. We summarise the part that changes a decision rather than copying a review; see the full citation policy.

• ZDI-25-949 / ZDI-25-950 advisories (CVE-2025-11001, CVE-2025-11002) ↗ — Trend Micro Zero Day Initiative · 2025 · Vulnerability disclosure. An archive tool is part of your attack surface, not just a convenience. We use these advisories to explain why 'extract to a folder first' and 'check the version manually' are real advice rather than filler.
• 7-Zip version history ↗ — 7-Zip / Igor Pavlov · Ongoing · Publisher's changelog. 7-Zip does not check for updates by itself. The changelog is the practical place to confirm you are on a current build, which is why we link it from the tool page rather than just saying 'keep it updated'.