CVE-2026-104025
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A Path Traversal (CWE-22) vulnerability in the execute_obj function of PeaZip's archive object viewer (peach.pas) in versions 11.2.0 and earlier on Windows allows an attacker to execute an arbitrary program already present on the victim's system. The attacker must convince the victim to preview a crafted archive entry via the "Preview with... -> Associated application" action (Shift+Ctrl+O), where the entry name contains "../" sequences that escape the temporary extraction directory and are passed to ShellExecuteW without warning. The flaw stems from missing validation of the tempstring and lack of path-containment check in checkfiledirname.
Risk Assessment
The organization is exposed to arbitrary code execution in the context of the user opening a crafted archive, potentially leading to system compromise, data theft, or further escalation. The risk is particularly high because the attack requires no administrative privileges and only a preview action from the victim.
Recommendation
Update PeaZip to a version later than 11.2.0 if available, or disable the "Preview with... -> Associated application" feature until a patch is released. Additionally, consider restricting the opening of untrusted archives and enforcing least privilege for users.
Other vulnerabilities in PeaZip
See all- CVE-2026-104024Medium
An Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer in PeaZip 10.5.0 through 11.2.0 on Windows affects how risky file types are handled. The SECEXTCONST list contains only seven extensions (exe, cmd, msi, bat, ps1, vbs, reg) and the check is an exact string comparison, so it misses other types executed via ShellExecuteW, including .url and .lnk. As a result, opening a crafted archive entry can execute a program or arbitrary command with no confirmation dialog.
- CVE-2026-105050High
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.
- CVE-2026-102514High
Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip.
Original NVD description (English source)
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS