CVE-2025-65318

Critical · CVSS 9.1

Canary Mail — Mark-of-the-Web (MotW) bypass via attachment save

CVSS: 9.1; nvd
EPSS: 0.48%; 38th pct
KEV: No
Class: other; CWE-693

Description

When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.

Search profile — drives PoC discovery

Symbols Mark-of-the-WebMotWZone.Identifierattachment interactionfile systemCVE-2025-65318CVE-2025-65319RTI-Toolkit

Keywords CVE-2025-65318Canary MailMark-of-the-Web bypassMotW bypassattachment saveZone.Identifier missingWindows file protection bypassCWE-693bbabohaRTI-Toolkitnickvourd

Versions: <= 5.1.40

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

bbaboha/CVE-2025-65318-and-CVE-2025-65319 needs review

cited in references

gh_search

★ 7

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z