Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104024— Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

Quick assessment

Affected
PeaZip PeaZip
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 PeaZip 10.5.0 至 11.2.0（Windows 版本）中，归档对象查看器（peach.pas、grid_obj_open）的“危险扩展确认”机制存在禁用输入列表不完整的问题（CWE-184）。攻击者可通过诱使受害者打开一个精心构造的归档文件中的某个条目，在无确认对话框的情况下执行任意程序或任意命令。 该确认提示（“您是否要运行此文件？”）依赖于 SECEXTCONST，这是一个硬编码的包含七个扩展名（exe、cmd、msi、bat、ps1、vbs、reg）的列表。该检查仅对条目扩展名与该列表进行精

CVSS 4.6 · Medium EPSS 0.13% · P2

Affected Version Matrix 1

VendorProduct Version RangeStatus
PeaZip PeaZip 10.5.0< 11.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104024

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation
Source: CVE Program / CVE List V5
Vulnerability Description
Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary command, with no confirmation dialog. The prompt (Do you want to run this file?) is gated by SECEXTCONST, a hard-coded list of seven extensions (exe cmd msi bat ps1 vbs reg); the check is an exact string comparison of the entry extension against that list, so it answers only whether the extension is one of the seven and never whether the shell will execute the file. Shell-executable and scripting-host types that Windows runs through ShellExecuteW are absent from the list, among them .url and .lnk. An archived Windows Internet Shortcut (.url) whose URL line is attacker-controlled is launched with no prompt, while the byte-identical content in an entry named .bat does raise the warning in the same session. A .lnk entry raises the ceiling from launching a program to running a command line, because a Windows shortcut carries arguments: a proof-of-concept shortcut targeting cmd.exe with an attacker-chosen command line executed with no prompt. The shortcut target is not confined to the local disk; the shell also resolved an attacker-named UNC path (fetching a remote payload was only attempted, not demonstrated). No privilege escalation; everything runs as the user who opened the archive.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不完整的黑名单
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PeaZip PeaZip 10.5.0 ~ 11.3.0 cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*

II. Public POCs for CVE-2026-104024

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104024

请登录查看更多情报信息。

Other References for CVE-2026-104024 (1)

IV. Related Vulnerabilities

Same product: PeaZip
Same vendor: PeaZip
Same weakness: CWE-184

V. Comments for CVE-2026-104024

No comments yet

Leave a comment