CVE-2026-104025
Received Received - Intake

Path Traversal in PeaZip Archive Viewer

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Secur0

Description
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-104025
EUVD
EUVD-2026-102023

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PeaZip PeaZip 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104025 is a high-severity path traversal vulnerability in PeaZip for Windows versions 11.2.0 and earlier. It occurs when a user previews a crafted archive entry using the 'Preview with associated application' function (Shift+Ctrl+O). The flaw allows an attacker to execute arbitrary programs on the victim's machine by crafting an entry name with parent directory segments (e.g., ../../../../Windows/System32/calc.exe) to escape the extraction directory. The code validates only the temporary directory path but not the archive entry name, leading to a mismatch in path handling where the preview function does not strip the traversal while the extraction backend does.

The vulnerability arises because the preview function concatenates the temporary directory path with the unvalidated archive entry name before execution via ShellExecuteW. Additionally, the dangerous-extension check that prompts for confirmation is only implemented in the double-click handler and not in the preview route, allowing executables to run unannounced.

Detection Guidance

To detect this vulnerability, monitor for unusual program executions triggered by PeaZip's preview feature. Check logs for entries where archive filenames contain path traversal sequences like "..\..\" or excessive parent directory references. Inspect PeaZip's temporary directories for unexpected files or executables.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary programs already present on your system without your knowledge or consent. If you use PeaZip 11.2.0 or earlier on Windows and preview a malicious archive entry using the 'Preview with associated application' feature, the attacker could run programs like calc.exe or other malicious software on your machine. This could lead to data theft, system compromise, or further malware installation.

Compliance Impact

This vulnerability could lead to unauthorized code execution on a user's system, potentially allowing attackers to access, modify, or exfiltrate sensitive data. For GDPR, this may result in unauthorized processing or disclosure of personal data, violating principles of data protection and user consent. Under HIPAA, such an exploit could compromise protected health information if the system handles medical data, leading to breaches of confidentiality and integrity requirements.

Mitigation Strategies

Upgrade PeaZip to version 11.3.0 or higher immediately. Disable the "Preview with associated application" feature (Shift+Ctrl+O) until patched. Avoid opening untrusted archives in PeaZip. Implement network monitoring for suspicious outbound connections from systems running vulnerable PeaZip versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104025. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart