CVE-2026-113609: Bandizip 0 to before 7.47

Affected technology

Bandizip · 0 to before 7.47
Bandisoft

Description’s affected range: before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and availability impact as none; integrity impact as low.

Published 20-Oct-2026 16:40 UTC

CWE: CWE-693
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 16:40:23.998050+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-113609.html