Mark-of-the-Web Bypass in Bandisoft Bandizip Affects PowerShell Script Execution
CVE-2026-113609

4.8MEDIUM

Key Information:

Vendor

Bandisoft

Status
Bandizip
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113609?

Bandisoft Bandizip before version 7.47 exhibits a vulnerability that fails to apply the Mark-of-the-Web attribute to extracted PowerShell (.ps1 and .psm1) files. This oversight allows malicious actors to deliver unsigned scripts or modules within downloaded archives, which can then execute bypassing the intended security measures under the RemoteSigned policy when invoked by users. As a result, this vulnerability poses a risk to users by potentially enabling unauthorized execution of harmful scripts.

Affected Version(s)

Bandizip 0 < 7.47

References

https://en.bandisoft.com/bandizip/history/
release-notesvendor-advisory
https://www.vulncheck.com/advisories/bandisoft-bandizip-b...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leon Kayaliev
.