CVE-2026-105050
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.
Risk Assessment
An attacker can execute arbitrary commands on the system, potentially leading to full system compromise.
Recommendation
Upgrade PeaZip to version 11.3.0 or later.
Other vulnerabilities in PeaZip
See all- CVE-2026-104024Medium
An Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer in PeaZip 10.5.0 through 11.2.0 on Windows affects how risky file types are handled. The SECEXTCONST list contains only seven extensions (exe, cmd, msi, bat, ps1, vbs, reg) and the check is an exact string comparison, so it misses other types executed via ShellExecuteW, including .url and .lnk. As a result, opening a crafted archive entry can execute a program or arbitrary command with no confirmation dialog.
- CVE-2026-102514High
Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip.
Original NVD description (English source)
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS