CVE-2026-113609: Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

Q: Who is exposed to this issue?

Users of Bandizip versions before 7.47 are exposed when they extract downloaded archives containing .ps1 or .psm1 files and then invoke those files. The issue is relevant where PowerShell relies on zone-based protections, including the RemoteSigned execution policy.

Q: What does an attacker need to exploit it?

An attacker needs to deliver a downloaded archive containing an unsigned PowerShell script or module and persuade the user to extract it with an affected Bandizip version and invoke the extracted file. No attacker privileges are required, but user interaction is required.

Q: How can I determine whether I am affected?

Check the installed Bandizip version. Versions before 7.47 are affected; version 7.47 is the stated fixed version.

Published Oct 20, 2026

Updated

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Affected Software

1 affected component

Bandisoft Bandizip<7.47

Event History

Oct 20, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Bandizip versions before 7.47 are exposed when they extract downloaded archives containing .ps1 or .psm1 files and then invoke those files. The issue is relevant where PowerShell relies on zone-based protections, including the RemoteSigned execution policy.

What does an attacker need to exploit it?

An attacker needs to deliver a downloaded archive containing an unsigned PowerShell script or module and persuade the user to extract it with an affected Bandizip version and invoke the extracted file. No attacker privileges are required, but user interaction is required.

How can I determine whether I am affected?

Check the installed Bandizip version. Versions before 7.47 are affected; version 7.47 is the stated fixed version.

CVE-2026-113609: Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether I am affected?