Vulnerability Description
In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/EnisAksu/Argonis/blob/main/CVEs/IZArc/IZArc%20Mark-of-the-Web
- https://github.com/EnisAksu/Argonis/security/advisories/GHSA-637g-8v47-79mv
- https://www.izarc.org/news
FAQ
What is CVE-2025-46652?
CVE-2025-46652 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extr...
How severe is CVE-2025-46652?
CVE-2025-46652 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-46652?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.