PeaZip vulnerabilities

An Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer in PeaZip 10.5.0 through 11.2.0 on Windows affects how risky file types are handled. The SECEXTCONST list contains only seven extensions (exe, cmd, msi, bat, ps1, vbs, reg) and the check is an exact string comparison, so it misses other types executed via ShellExecuteW, including .url and .lnk. As a result, opening a crafted archive entry can execute a program or arbitrary command with no confirmation dialog.

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.

Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip.