CVE-2026-113609 in Bandizip
Summary
by MITRE • 10/20/2026
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Bandizip versions prior to 7.47 represents a significant security flaw related to how archive extraction utilities handle file metadata, specifically the Mark-of-the-Web mechanism. This issue falls squarely within the CWE category of Improper Restriction of Operations within the Bounds of a Memory Buffer or more accurately under CWE-284: Improper Access Control and CWE-150: Improper Neutralization of Escape Metacharacters in Data, as it involves the failure to preserve security-critical attributes during file system operations. The Mark-of-the-Web is a Windows feature designed to tag files downloaded from the internet with zone information, which informs operating system policies about the trustworthiness and origin of the content. When an archive containing such tagged files is extracted by vulnerable versions of Bandizip, these tags are not propagated to the newly created files on the local file system. This behavior effectively strips the security context that Windows relies upon to enforce execution restrictions, creating a dangerous gap in defense-in-depth strategies.
From an operational perspective, this flaw allows attackers to bypass zone-based execution protections by delivering malicious PowerShell scripts or modules within downloaded archives. Under standard Windows configurations utilizing the RemoteSigned execution policy, unsigned scripts originating from the internet are blocked from running unless they possess valid digital signatures. However, because Bandizip fails to preserve the Mark-of-the-Web during extraction, the resulting .ps1 and .psm1 files appear to originate from a local or trusted zone rather than an untrusted remote source. Consequently, when a user attempts to invoke these scripts, Windows does not recognize them as internet-downloaded content and permits their execution without requiring authentication or signature verification. This mechanism is frequently exploited in phishing campaigns where malicious archives are distributed via email attachments or compromised websites, leveraging social engineering to trick users into extracting and running the contained payloads.
The impact of this vulnerability extends beyond simple script execution; it facilitates arbitrary code execution with the privileges of the invoking user. Attackers can leverage PowerShell modules to download additional malware, establish persistence mechanisms, exfiltrate sensitive data, or pivot within a network environment. The absence of proper metadata propagation means that security tools relying on file zone information for heuristic analysis may also fail to flag these files as suspicious initially. This aligns with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter, specifically PowerShell execution, and T1204 User Execution, where the attacker relies on user interaction to trigger the malicious activity. The failure to maintain security attributes during file manipulation is a common pitfall in software development that undermines OS-level safeguards intended to mitigate drive-by downloads and phishing-based attacks.
To mitigate this risk, organizations should immediately update Bandizip to version 7.47 or later, where the developers have addressed the issue by ensuring that Mark-of-the-Web attributes are correctly preserved during extraction processes. In environments where immediate patching is not feasible, administrators can implement additional controls such as application whitelisting to prevent unauthorized PowerShell execution, particularly for unsigned scripts. Endpoint detection and response solutions should be configured to monitor for unusual file creation patterns associated with archive extraction tools that result in the sudden appearance of executable or script files without corresponding zone information. Furthermore, user awareness training is critical; employees must be educated on the risks of extracting archives from untrusted sources and instructed not to enable content or run scripts prompted by security warnings, even if those warnings are absent due to this specific vulnerability. Regular audits of file integrity and monitoring for anomalous PowerShell activity can help detect exploitation attempts that bypass traditional perimeter defenses.