CVE-2026-113609: Bandisoft Bandizip, логическа грешка

Описание

Оригинално описание

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Засегнати продукти

• Bandisoft Bandizip: преди 7.47

Вид слабост

• CWE-693 Protection Mechanism Failure

История

Други уязвимости в Bandisoft Bandizip

• 6.1CVE-2025-33027

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-113609
• https://nvd.nist.gov/vuln/detail/CVE-2026-113609
• https://en.bandisoft.com/bandizip/history/
• https://www.vulncheck.com/advisories/bandisoft-bandizip-before-7.47-mark-of-the-web-bypass-for-powershell-scripts