Bandizip before version 7.47 does not attach the Mark‑of‑the‑Web metadata to extracted .ps1 or .psm1 files. Consequently, Windows and PowerShell treat these files as local, allowing them to be executed under a RemoteSigned policy even though they are unsigned. This flaw enables an attacker to embed malicious scripts in an archive that a user will extract, bypassing zone‑based protection. The weakness is classified as CWE‑693, improper restriction of operations.

All deployments of Bandisoft Bandizip earlier than version 7.47 are affected. The vulnerability applies to the Windows product Bandizip from Bandisoft; no further version granularity is provided, so any installation that has not been upgraded to 7.47 or later may be vulnerable.

The flaw carries a CVSS score of 4.8, indicating moderate severity and no inherent network dependency. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits. Based on the description, it is inferred that the primary attack vector is an attacker delivering a malicious archive with unsigned PowerShell scripts that a user downloads or receives from an untrusted source. When the user extracts the archive with Bandizip, the scripts run under the user’s PowerShell policy, allowing execution of arbitrary code with the user’s privileges.