CVE-2025-33027: bandisoft bandizip

Vulnerability summary

CVE-2025-33027 is a high (CVSS 7.8) vulnerability in bandisoft bandizip. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities.

Timeline

1. 15-04-2025
   PublishedVulnerability first disclosed.
2. 24-10-2025
   Last modifiedVulnerability information updated.

Description

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, Bandizip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.

• CWE-830Inclusion of Web Functionality from an Untrusted SourceThe product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.