CVE-2025-50327: ZPAQFRANZ RCE Vulnerability

CVE-2025-50327 Overview

CVE-2025-50327 affects Franco Corbelli's ZPAQFRANZ archiver utility, version 61.3 and earlier. The flaw allows a remote attacker to bypass the Windows Mark-of-the-Web (MOTW) protection mechanism when files are extracted from archives. Once MOTW propagation fails, downloaded content loses its untrusted origin marker and executes without the security warnings that Windows normally enforces on internet-sourced files. Successful exploitation leads to privilege escalation and arbitrary code execution on the target system.

Critical Impact
Attackers can deliver crafted ZPAQFRANZ archives that, once extracted, produce files stripped of MOTW metadata, enabling arbitrary code execution and privilege escalation on Windows hosts.

Affected Products

Franco Corbelli ZPAQFRANZ version 61.3
Franco Corbelli ZPAQFRANZ versions prior to 61.3
Windows systems using ZPAQFRANZ for archive extraction

Discovery Timeline

2026-07-22 - CVE-2025-50327 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2025-50327

Vulnerability Analysis

Mark-of-the-Web is a Windows security control that tags files originating from untrusted sources such as the internet. Windows records this provenance in the Zone.Identifier NTFS Alternate Data Stream. Applications like Microsoft Office, SmartScreen, and AppLocker rely on this tag to trigger Protected View, block macros, and warn users before execution.

ZPAQFRANZ is a file archiver derived from the ZPAQ format that supports deduplication and journaled backups. When ZPAQFRANZ extracts an archive downloaded from the internet, it fails to propagate the parent archive's Zone.Identifier stream to the extracted child files. Extracted executables, scripts, and Office documents therefore appear to Windows as locally created content.

An attacker who convinces a user to open a malicious ZPAQFRANZ archive can drop payloads that run without the usual MOTW-driven mitigations. The bypass converts a user-assisted delivery into effective arbitrary code execution.

Root Cause

The archiver does not read the Zone.Identifier ADS from the source archive and does not write an equivalent stream onto extracted files. This is an instance of missing security constraint propagation during file materialization, aligned with weaknesses tracked under improper enforcement of MOTW.

Attack Vector

The attacker hosts a crafted ZPAQFRANZ archive on a website, phishing link, or shared drive. The victim downloads the archive, which correctly receives MOTW from the browser. When the victim extracts the archive with a vulnerable ZPAQFRANZ build, the payload files land on disk without MOTW. Executing those files bypasses SmartScreen prompts and Office Protected View, allowing macros, scripts, or binaries to run with the user's privileges. See the public reference for CVE-2025-50327 for reproduction details.

Detection Methods for CVE-2025-50327

Indicators of Compromise

Presence of zpaqfranz.exe version 61.3 or earlier on Windows endpoints.
Extracted files from .zpaq archives that lack a Zone.Identifier alternate data stream despite the parent archive carrying one.
Execution of scripts or binaries from user download directories immediately following zpaqfranz process activity.

Detection Strategies

Hunt for child processes spawned by zpaqfranz.exe that write executables, .lnk, .hta, .js, or Office documents into user-writable paths.
Correlate browser download events for .zpaq files with subsequent process creation of extracted payloads that carry no MOTW tag.
Flag Office applications loading macro-enabled documents originating from zpaqfranz extractions without Protected View being triggered.

Monitoring Recommendations

Enable Sysmon Event ID 15 (FileCreateStreamHash) to observe missing Zone.Identifier streams on files derived from downloaded archives.
Log command-line invocations of zpaqfranz and alert on x or extract operations targeting internet-sourced archives.
Track anomalous execution of newly written files whose parent directory received recent archive extraction activity.

How to Mitigate CVE-2025-50327

Immediate Actions Required

Upgrade ZPAQFRANZ to a release later than 61.3 that propagates MOTW. Refer to the ZPAQFRANZ release notes.
Inventory endpoints for any installed zpaqfranz binaries and remove unmanaged copies.
Restrict execution of files extracted from .zpaq archives until the update is deployed.

Patch Information

The vendor publishes fixed builds through the official ZPAQFRANZ GitHub releases page. Administrators should validate that deployed versions are newer than 61.3 and confirm that extracted files carry the expected Zone.Identifier stream after extraction.

Workarounds

Block or quarantine .zpaq archives at the email gateway and web proxy until patched builds are rolled out.
Manually apply MOTW to extracted files using Add-Content -Path <file> -Stream Zone.Identifier with a zone value of 3 before execution.
Enforce Windows Defender Application Control or AppLocker policies that block script and executable launches from user download folders.

bash

# Verify Zone.Identifier is preserved after extraction (PowerShell)
Get-Item .\extracted_file.exe -Stream Zone.Identifier

# Manually apply MOTW when a patched build is not yet available
Set-Content -Path .\extracted_file.exe -Stream Zone.Identifier -Value "[ZoneTransfer]`nZoneId=3"