CVE-2026-104025: Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
Path Traversal (CWE-22) in the executeobj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (listutils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cpopen -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (gridobjopen) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PeaZipto a version that resolves this vulnerability.Fixed in 11.3.0Patch 009fc35
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects PeaZip 11.2.0 and earlier on Windows. The vulnerable path is the archive object viewer's preview action.
What must an attacker do to trigger exploitation?
An attacker must provide a crafted archive and convince the victim to select a malicious entry and use “Preview with... -> Associated application” (Shift+Ctrl+O). The archive entry name supplies the unvalidated path component used by the preview route.
What is the practical execution impact?
The attacker can cause PeaZip to invoke an arbitrary program that is already present on the victim's system, such as a Windows system executable reached through traversal sequences. This preview route does not display the dangerous-extension confirmation prompt.