Mark-of-the-Web

7-Zip RAR5 Mark-of-the-Web / ADS Full-Chain Bypass

7-Zip 26.01 on Windows mishandles RAR5 archives that contain crafted STM (stream) service records alongside a normal file entry. By naming one stream ::$DATA and another :Zone.Identifier:$DATA, an attacker can make the archive-provided data silently override…