CVE-2026-105050: Command Injection

Q: Which deployments are affected?

The issue affects PeaZip versions before 11.3.0 only when using the non-default configuration implicated by the vulnerability. Default configurations are not identified as affected by the provided information.

Q: What does an attacker need to exploit this?

An attacker needs to supply or induce processing of an archive containing a filename crafted to trigger the quotation-character handling flaw. The vulnerable non-default configuration must be in use.

Q: What version addresses the issue?

PeaZip 11.3.0 is identified as the release boundary for this issue; versions before 11.3.0 are affected under the stated non-default configuration.

Published Oct 2, 2026

Updated

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.

Affected Software

1 affected component

PeaZip PeaZip<11.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PeaZip to a version that resolves this vulnerability.
Fixed in 11.3.0

Event History

Oct 2, 2026

CVE Published

via MITRE·10:37 PM

Data Sourced

via MITRE·10:37 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

The issue affects PeaZip versions before 11.3.0 only when using the non-default configuration implicated by the vulnerability. Default configurations are not identified as affected by the provided information.

What does an attacker need to exploit this?

An attacker needs to supply or induce processing of an archive containing a filename crafted to trigger the quotation-character handling flaw. The vulnerable non-default configuration must be in use.

What version addresses the issue?

PeaZip 11.3.0 is identified as the release boundary for this issue; versions before 11.3.0 are affected under the stated non-default configuration.

CVE-2026-105050: Command Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What version addresses the issue?