Critical severity · published Dec 16, 2025
CVE-2025-65318
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass…
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Canary Mail · Canarymail
through 5.1.40 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65318
Exploit
https://drive.google.com/file/d/14wrTzvcLPfFsWmy-SAtDwwZKKPssBsx5/view
Exploit
https://github.com/bbaboha/CVE-2025-65318-and-CVE-2025-65319
Not Applicable
https://github.com/nickvourd/RTI-Toolkit
More from Canary Mail
7.4
CVE-2021-26911
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode