diff --git a/advisories/unreviewed/2025/08/GHSA-58pw-r2v4-pwjv/GHSA-58pw-r2v4-pwjv.json b/advisories/unreviewed/2025/08/GHSA-58pw-r2v4-pwjv/GHSA-58pw-r2v4-pwjv.json index e340fb13ab1ed..cf8b2ecfde5a5 100644 --- a/advisories/unreviewed/2025/08/GHSA-58pw-r2v4-pwjv/GHSA-58pw-r2v4-pwjv.json +++ b/advisories/unreviewed/2025/08/GHSA-58pw-r2v4-pwjv/GHSA-58pw-r2v4-pwjv.json @@ -6,7 +6,7 @@ "aliases": [ "CVE-2025-55188" ], - "details": "7-Zip before 25.01 does not always properly handle symbolic links during extraction.", + "details": "7-Zip before 25.01 does not always properly handle symbolic links during extraction. NOTE: this vulnerability exists because of an incomplete fix for CVE-2025-11001. This symlink handling issue is related to CVE-2025-11001(https://github.com/advisories/GHSA-h6cw-8q9x-9gj9), which introduced symlink path traversal protections in 7-Zip 25.00. An edge case in those protections allowed bypass, fixed in 25.01.", "severity": [ { "type": "CVSS_V3", @@ -85,4 +85,4 @@ "github_reviewed_at": null, "nvd_published_at": "2025-08-08T21:15:25Z" } -} \ No newline at end of file +}