Description
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Published: 2026-10-15
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Path traversal in PeaZip’s execute_obj function allows an attacker to craft an archive entry name that bypasses the utility’s temporary directory containment checks and causes the archive viewer to run an arbitrary program already on the victim’s machine. The flaw is present because the code concatenates the verified extraction location with the raw archive entry name, which is never validated, and the security prompt for dangerous extensions runs only on double‑click, not on the preview route. This results in silent execution of any executable in the archive or on the file system, giving an attacker full code‑execution capabilities on the victim’s Windows system.

Affected Systems

PeaZip versions 11.2.0 through 11.2.x running on Windows are affected. The vulnerability is resolved in PeaZip 11.3.0 and later by sanitizing the archive entry name and enforcing containment of the resolved path.

Risk and Exploitability

The flaw carries a CVSS score of 8.4 (High) and an EPSS score of less than 1 %, indicating a presently low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure a user of PeaZip to preview a crafted archive entry via the "Preview with… => Associated application" option (Shift + Ctrl + O) or a double‑click. Once the preview trigger is activated, the unvalidated path is passed to ShellExecuteW, leading to arbitrary code execution with no user warning.

Generated by OpenCVE AI on October 16, 2026 at 21:21 UTC.

Remediation

Vendor Solution

Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping ../ and ..\ sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the "Open/Preview with associated application" route, not only the double-click event. Fix commit 009fc35 (2026-09-03).

OpenCVE Recommended Actions

  • Upgrade PeaZip to version 11.3.0 or newer to apply the vendor‑supplied path‑sanitization patch.
  • If an upgrade is not immediately possible, disable the "Preview with…" function for untrusted archives or remove the Shift + Ctrl + O shortcut to prevent accidental execution of archive contents.
  • Use application control or policy settings to block or flag unexpected ShellExecuteW calls originating from PeaZip as a temporary mitigative measure.

Generated by OpenCVE AI on October 16, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Title Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
First Time appeared Peazip
Peazip peazip
Weaknesses CWE-22
CWE-693
CPEs cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*
Vendors & Products Peazip
Peazip peazip
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Peazip Peazip
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-10-15T13:11:13.654Z

Reserved: 2026-10-01T17:09:25.587Z

Link: CVE-2026-104025

cve-icon Vulnrichment

Updated: 2026-10-15T13:11:10.013Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T13:17:10.617

Modified: 2026-10-16T19:56:15.773

Link: CVE-2026-104025

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-15T12:00:49Z

Links: CVE-2026-104025 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:45:16Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-693

    Protection Mechanism Failure