Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104025— Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

Quick assessment

Affected
PeaZip PeaZip
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

路径遍历漏洞（CWE-22）存在于 PeaZip 11.2.0 及更早版本的 Windows 平台中，具体位于“归档对象查看器”（archive object viewer）的 函数（定义于 peach.pas 文件）。攻击者可通过构造恶意归档文件，诱导用户在“用...预览 -> 关联应用程序”操作（快捷键 Shift+Ctrl+O）中预览该归档中的特定条目，从而在受害者系统上无需任何警告对话框即可执行任意程序。 该函数仅使用 对 （PeaZip 自身的临时目录）进行验证，而实际执行的命令字符串是 的拼接结果；其中

CVSS 8.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104025

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
Source: CVE Program / CVE List V5
Vulnerability Description
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PeaZip PeaZip 0 ~ 11.3.0 cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*

II. Public POCs for CVE-2026-104025

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104025

请登录查看更多情报信息。

Other References for CVE-2026-104025 (1)

IV. Related Vulnerabilities

Same product: PeaZip
Same vendor: PeaZip
Same weakness: CWE-22

V. Comments for CVE-2026-104025

No comments yet

Leave a comment