Live › vulnerability › CVE-2026-113609
Go to dashboardBandizip before 7.47 does not carry the Mark-of-the-Web flag onto .ps1 and .psm1 files it extracts from archives. An attacker who ships an unsigned script in a downloaded archive can get it to run under the RemoteSigned PowerShell policy when the user invokes it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Windows users and teams who extract archives downloaded from the internet with Bandizip and then run PowerShell scripts from them under RemoteSigned. Systems that do not use Bandizip, or that run PowerShell under AllSigned or stricter policies, are less exposed. Teams that do not extract untrusted archives can skip it.
No product ranges from the sources yet.
7.47 are affected..ps1 from a file downloaded from the internet and check whether the extracted file has a Zone.Identifier stream (Get-Item file.ps1 -Stream *).7.47 or later..ps1 or .psm1 files extracted from untrusted archives.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.
This page as .md · .json · in your agent: get_signal("CVE-2026-113609")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.