CVE-2026-104025

Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

• CWE-22
• CWE-693

• https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf
• https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104019OS command injection in the Studio Space startup validation …9
• CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Pytho…7.5
• CVE-2026-104021The Fastcache by Host.it plugin for WordPress is vulnerable …7.2
• CVE-2026-104022The Academy LMS – AI Course Builder, Quizzes, Certificates &…5.4
• CVE-2026-104023The Smart Popup by Supsystic plugin for WordPress is vulnera…4.9
• CVE-2026-104024Incomplete List of Disallowed Inputs (CWE-184) in the danger…4.6
• CVE-2026-104026In Sapling SCM prior to v0.2.20260929-102736, control charac…7.8
• CVE-2026-104028The Anton Extensions WordPress plugin through 1.2.2 does not…9.8
• CVE-2026-104029A flaw was found in SSSD. A local attacker can exploit this …5.5
• CVE-2026-104030A flaw was found in sssd. This vulnerability allows a local …5.5
• CVE-2026-104031A flaw was found in SSSD. In configurations where the autofs…5.5
• CVE-2026-104032A flaw was found in SSSD. An unprivileged local user can rep…5.5