I just did some testing and it&#x27;s even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only.<p>So simply opening a malicious &quot;.zip&quot; file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface.<p>EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.