CVE-2025-65318: Canarymail Canary Mail

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.

Affected products

• Canarymail Canary Mail: up to and including 5.1.40

Published 2025-12-16. Last modified 2026-07-05.