Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Hackathons / CTFs Tailor-made events
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-104025 ·
High · October 15, 2026

Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

S0
Secur0 CNA
CVE-2026-104025

Description

Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the Preview with... -> Associated application action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim machine, with no warning dialog. The function validates only outname (the PeaZip temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...], at peach.pas:51341) and is never validated. checkfiledirname (list_utils.pas:1739) rejects control and reserved characters in the file name but performs no .. path-containment check, so an entry name made of several .. segments followed by Windows/System32/calc.exe (enough to climb to the drive root) escapes the extraction directory and is passed straight to cp_open->ShellExecuteW. The extracting backend (7-Zip) strips the .. on extraction while the opener does not: the two halves of the same operation disagree. In addition, the SECEXTCONST dangerous-extension prompt (Do you want to run this file?) is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced; and where the prompt does fire, it displays the entry display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect lies in the PeaZip path handling and not in a single format parser.

Vulnerability type (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

CWE-693: Protection Mechanism Failure

Affected versions

All versions of PeaZip for Windows prior to 11.3.0. The vulnerable code is traceable at least to version 8.7 (commit 64d4aa6, 25/06/2022, the first version with source code on GitHub). Default status: affected.

Score (CVSS 4.0)

High (8.4)

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Solution

Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping parent-directory (..) and backslash-equivalent sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the Open/Preview with associated application route, not only the double-click event.

Patch

Commit 009fc35530e26729863969eddf4c18f1b48331cf

Credits

  • cgomezpob - finder
  • Darío Rivas Quero - analyst
  • Secur0 CNA - coordinator

Discovery source: External

Official record: CVE-2026-104025