> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2025-0411: 7-Zip Mark-of-the-Web Bypass Vulnerability - URL: https://darkwebinformer.com/cve-2025-0411-7-zip-mark-of-the-web-bypass-vulnerability/ - Published: 2025-01-22T21:57:32.000Z - Updated: 2025-09-04T22:24:22.000Z - Author: Dark Web Informer - Tags: Vulnerabilities, Tools --- GitHub: --- [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#7-zip-mark-of-the-web-bypass-vulnerability-cve-2025-0411---poc) ## CVE-2025-0411 Details [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#cve-2025-0411-details) "This vulnerability (CVSS SCORE 7.0) allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user." ## Vulnerable Versions [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#vulnerable-versions) - All versions before **24.09** are considered vulnerable. ## Mitigations [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#mitigations) - "Update 7-Zip: Download and install version 24.09 or later from the official 7-Zip website." - "Exercise Caution with Untrusted Files: Avoid opening files from unknown or suspicious sources, especially compressed archives." - "Leverage Security Features: Ensure that your operating system and security software are configured to detect and block malicious files." ## Proof Of Concept [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#proof-of-concept) As part of POC a simple loader of calc.exe is implemented. ### Weaponization [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#weaponization) The methodology is to double compress the executable which triggers the vulnerability. ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/01/405663889-90061d91-f7b3-4d15-ba29-45e09fe97a09.png) ### Delivery [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#delivery) Next, the double compressed 7Zip file is uploaded on a payload delivery server (in this scenario MediaFire) and delivered to the victim i.e. through phishing emails serving the malicious URL. Upon downloading the file, the "MotW" (Zone.Identifier - The origin of the download) can be seen: ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/01/405663823-dd0a1975-308c-49a8-a938-521eb3c751a6.gif) ### Execution [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#execution) As part of the execution the victim needs to click through the compressed files and run the executable. #### Patched Version [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#patched-version) In this scenario the 7Zip 24.09 version (patched) is used which displays the Windows SmartScreen warning that this file comes from an untrusted source (since it contains the MotW). ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/01/405663908-616172f1-5eae-47e4-b42d-a8bb0347a068.gif) #### Vulnerable Version [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#vulnerable-version) In this scenario the 7Zip 24.07 version (vulnerable) is used which allows direct execution of the executable without displaying any warnings (since it does not contain the MotW). ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/01/405663930-a0e84f09-aec8-4c07-88cd-be1227c1325f.gif) ## References [](https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC#references) - - -