CVE-2025-46652 (CVSS 6.1)

Description

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.

Is your site exposed to CVE-2025-46652?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness Type (CWE)

CWE-830 CWE-830

References

Other References

https://github.com/EnisAksu/Argonis/blob/main/CVEs/IZArc/IZArc%20Mark-of-the-Web%20Bypass%20Vulnerability.md https://github.com/EnisAksu/Argonis/security/advisories/GHSA-637g-8v47-79mv https://www.izarc.org/news

Frequently Asked Questions

What is CVE-2025-46652? +

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content. It has a CVSS v3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2025-46652? +

CVE-2025-46652 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

How do I check if I'm vulnerable to CVE-2025-46652? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-65109

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from …

CVE-2024-29944 8.4

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in …

CVE-2024-42381 8.3

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to …

CVE-2025-64496 7.3

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code …

CVE-2025-43703 6.1

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the …

CVE-2024-35180 6.1

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter …

CVE-2025-46652