Executive brief
ZipGenius, a popular file compression and archiving utility, contains a security flaw that fails to properly label extracted files as coming from the internet. This allows a malicious archive to bypass standard Windows security warnings (Mark-of-the-Web), potentially leading to the execution of harmful code if a user opens a file from a downloaded archive. An attacker could use this to gain unauthorized access to a user's system or data.
Technical details
A Protection Mechanism Failure (CWE-693) exists in ZipGenius versions up to 6.3.2.3116. When the application extracts files from an archive that possesses the 'Mark-of-the-Web' (MotW) NTFS alternate data stream, it fails to propagate this security zone identifier to the resulting extracted files. An attacker can exploit this by tricking a user into downloading and extracting a malicious archive; because the extracted files lack the MotW attribute, Windows will not trigger security warnings (such as SmartScreen or Protected View) when the malicious files are executed. This allows for arbitrary code execution in the context of the current user.
Affected products
- ZipGenius Team ZipGenius 6.3.2.3116 and earlier
Timeline
- 2026-07-22: disclosed: CVE published to NVD