CVE-2026-104025
8.4HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22, CWE-693
Impact
Attackers can execute arbitrary local binaries with the logged-in user's privileges without any warning prompt. This requires tricking a victim into opening a crafted archive and previewing an entry via the 'Preview with... -> Associated application' shortcut.
Root cause
The archive object preview handler executes concatenated paths using an unvalidated entry name containing directory traversal sequences without checking path containment or enforcing dangerous extension warnings.
Affected systems
PeaZip 11.2.0 and earlier on Windows
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to a version newer than 11.2.0 containing commit 009fc35530e26729863969eddf4c18f1b48331cf. As an interim workaround, avoid using Shift+Ctrl+O ('Preview with... -> Associated application') on untrusted archives.
$ winget upgrade PeaZip.PeaZipAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.