{"id":"CVE-2025-46652","aliases":["EUVD-2025-12481","GHSA-wx5g-qh7q-x3p7"],"status":"disputed","title":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an...","description":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0033,"percentile":0.26393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-830"],"published":"2025-04-26T00:00:00Z","modified":"2026-06-17T09:26:46Z","products":[{"vendor":"izarc","product":"izarc"}],"references":[{"url":"https://github.com/EnisAksu/Argonis/blob/main/CVEs/IZArc/IZArc%20Mark-of-the-Web%20Bypass%20Vulnerability.md"},{"url":"https://github.com/EnisAksu/Argonis/security/advisories/GHSA-637g-8v47-79mv"},{"url":"https://www.izarc.org/news"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46652"},{"url":"https://github.com/advisories/GHSA-wx5g-qh7q-x3p7"}],"sources":{"cve":[{"id":"CVE-2025-46652","description":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.","status":"disputed","published":"2025-04-26T00:00:00Z","modified":"2025-10-24T19:23:47.167Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-830"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-12481","description":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.","status":"published","published":"2025-04-26T00:00:00Z","modified":"2025-10-24T19:23:47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:37.392201Z"}],"ghsa":[{"id":"GHSA-wx5g-qh7q-x3p7","title":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an...","description":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files.","status":"published","published":"2025-04-26T18:30:34Z","modified":"2025-04-26T18:30:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-830"],"updated_at":"2026-11-02T15:02:02.261137Z"}],"nvd":[{"id":"CVE-2025-46652","description":"In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.","status":"disputed","published":"2025-04-26T18:15:31.297Z","modified":"2026-06-17T09:26:46.617Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-830"],"updated_at":"2026-11-02T14:11:02.570368Z"}]}}