PT-2025-16366 · Bandizip · Bandizip

Enis Aksu

·

Published

2025-04-15

·

Updated

2025-10-24

·

CVE-2025-33027

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Bandizip versions 7.37 and earlier
Description A Mark-of-the-Web Bypass Vulnerability exists in Bandizip, allowing attackers to bypass the Mark-of-the-Web protection mechanism on affected installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files, where Bandizip does not propagate the Mark-of-the-Web to the extracted files when extracting from a crafted archive. This enables an attacker to execute arbitrary code in the context of the current user.
Recommendations For Bandizip versions 7.37 and earlier, update to a version that includes a fix for this vulnerability. As a temporary workaround, consider avoiding the extraction of files from archives that may bear the Mark-of-the-Web until a patch is available. Restrict access to potentially malicious files and websites to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-830CWE-829

Related Identifiers

CVE-2025-33027

Affected Products

Bandizip