CVE-2025-65318-and-CVE-2025-65319

CVE-2025-65318 和 CVE-2025-65319 的概念验证（PoC） CVE-2025-65318 （BDU:2025-13740 ）： 使用附件交互功能时，Canary Mail 5.1.40 及更低版本将文档保存到文件系统时未添加 Mark-of-the-Web 标记，从而允许攻击者绕过 Windows 操作系统及第三方软件的内置文件保护机制。 CVE-2025-65319 （BDU:2025-13739 ）： 使用附件交互功能时，Blue Mail 1.140.103 及更低版本将文档保存到文件系统时未添加 Mark-of-the-Web 标记，从而允许攻击者绕过...

CVE-2025-65318

When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

CVE-2025-65319

When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

CVE-2025-65319

When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

CVE-2025-65318

When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

CVE-2025-65319

When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software...

CVE-2025-65318

Canary Mail version 5.1.40 and below is vulnerable to a protection mechanism failure (CWE-693) within its attachment interaction functionality. The software fails to apply a Mark-of-the-Web tag when saving documents to the file system. This oversight allows attackers to bypass the built-in file p...