CVE-2026-105050: Command Injection
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PeaZipto a version that resolves this vulnerability.Fixed in 11.3.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects PeaZip versions before 11.3.0 only when using the non-default configuration implicated by the vulnerability. Default configurations are not identified as affected by the provided information.
What does an attacker need to exploit this?
An attacker needs to supply or induce processing of an archive containing a filename crafted to trigger the quotation-character handling flaw. The vulnerable non-default configuration must be in use.
What version addresses the issue?
PeaZip 11.3.0 is identified as the release boundary for this issue; versions before 11.3.0 are affected under the stated non-default configuration.