CVE-2026-113609
LowCVSS 3.3Summary
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.
Risk Assessment
A user opening a malicious archive may unknowingly execute an unsigned PowerShell script without zone warnings. This may lead to malicious code execution on the victim's system.
Recommendation
Upgrade Bandizip to version 7.47 or later. Educate users about the risk of running PowerShell scripts from downloaded archives.
Other vulnerabilities in Bandizip
Original NVD description (English source)
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS