In PeaZip 10.5.0 to 11.2.0 for Windows, the application fails to flag several shell‑executable extensions in its dangerous‑extension confirmation list. The list is hard‑coded to only seven extensions (exe, cmd, msi, bat, ps1, vbs, reg) and ignores types such as .url and .lnk. An archive entry containing an Internet shortcut or a Windows shortcut can thus be opened without a confirmation dialog and will launch the target program or execute a command line with the user's credentials. The flaw is described by CWE‑184 and CWE‑693 and allows arbitrary code execution without privilege escalation. No direct network exploitation is required; the victim must manually open a crafted archive entry.

The vulnerability affects PeaZip values 10.5.0 through 11.2.0 running on Windows. The known vendor is PeaZip, product PeaZip, version range as cited above. No other operating systems or products are listed. The fix is available in version 11.3.0 and later.

The CVSS score is 4.6, indicating low severity, and the EPSS score is below 1 %, reflecting a very low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Nevertheless, exploitation is trivial for a user that opens a crafted archive; a malicious actor can lures a victim into opening such an archive to run arbitrary commands as that user. Because the attack vector requires user interaction and the target is a local user, the overall risk remains low, but the potential impact warrants prompt patching.