Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and
CVE-2026-104025
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104025
PeaZip
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"
],
"repo": "https://github.com/peazip/PeaZip",
"vendor": "PeaZip",
"modules": [
"archive object preview/open (execute_obj in peach.pas)"
],
"product": "PeaZip",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "11.3.0",
"versionType": "semver"
}
],
"platforms": [
"Windows"
],
"programFiles": [
"peazip-sources/dev/peach.pas",
"peazip-sources/dev/list_utils.pas"
],
"collectionURL": "https://github.com/peazip/PeaZip/releases",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "execute_obj"
},
{
"name": "checkfiledirname"
}
]
}
]- Related CVEs
- CVE-2026-104025
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28679 · Revision 1
- Added to Heist Feed
- Publisher date