CVE-2026-113609: Protection Mechanism Failure in Bandisoft Bandizip

CVE-2026-113609 describes a protection mechanism failure in Bandisoft Bandizip prior to version 7.47. The vulnerability arises because Bandizip fails to propagate the Mark-of-the-Web attribute to extracted PowerShell script files (.ps1 and .psm1). The Mark-of-the-Web is a security feature used by Windows to indicate that a file originated from an untrusted zone, such as the internet, and enforces execution restrictions accordingly. Without this attribute, PowerShell scripts extracted from downloaded archives may run under the less restrictive RemoteSigned policy, allowing unsigned scripts to execute. This behavior can be exploited by attackers who deliver malicious unsigned PowerShell scripts or modules within archives, potentially bypassing zone-based execution protections.

The vulnerability allows attackers to bypass Windows zone-based execution protections by delivering unsigned PowerShell scripts or modules in archives. When these files are extracted by vulnerable versions of Bandizip, they lack the Mark-of-the-Web attribute, causing them to run under the RemoteSigned policy instead of being blocked or restricted. This can lead to execution of potentially malicious scripts when invoked by the user. The CVSS 4.0 base score is 4.8 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

A fixed version of Bandizip is available starting from version 7.47 that addresses this issue by properly propagating the Mark-of-the-Web attribute to extracted PowerShell script files. Users should upgrade to Bandizip 7.47 or later to mitigate this vulnerability. No additional vendor advisory or patch links were provided, so users should verify the availability of the update from official Bandisoft sources. Until upgraded, users should exercise caution when extracting and executing PowerShell scripts from downloaded archives.