CVE-2025-50325

MediumCVSS 5.4

Published: 22/07/2026(UTC)Updated: 13/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

BandiZip v.7.37 is affected by an Authentication Bypass Vulnerability that allows remote attackers to bypass the Mark-of-the-Web protection mechanism.

Risk Assessment

The risk is bypassing Mark-of-the-Web protections, potentially allowing an attacker to execute malicious code without user warning.

Recommendation

Update BandiZip to the latest version and exercise caution when opening files from untrusted sources.

Other vulnerabilities in BandiZip

CVE-2026-113609Low
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Original NVD description (English source)

BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of BandiZip

Vulnerability data from NVD (NIST) · CISA KEV · EPSS