---
id: CVE-2026-113609
title: Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts
summary: >-
  Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted
  .ps1 and .psm1 files, allowing attackers to bypass zone-based execution
  protections. Attackers can deliver unsigned PowerShell scripts or modules in
  downloade…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-693
vendor: Bandisoft
product: Bandizip
affected:
  - Bandizip < 7.47
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T16:20:07.429835Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T16:20:16.264Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113609'
references:
  - url: 'https://en.bandisoft.com/bandizip/history/'
  - url: >-
      https://www.vulncheck.com/advisories/bandisoft-bandizip-before-7.47-mark-of-the-web-bypass-for-powershell-scripts
    label: >-
      VulnCheck Advisory: Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass
      for PowerShell Scripts
tags:
  - cve.org
ingestedAt: '2026-10-20T16:10:53.301Z'
---

## Overview

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

## Affected

- `Bandizip < 7.47`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.