Key points
- PeaZip versions before 11.3.0 are affected by CVE-2026-104025.
- The flaw allows silent execution of programs already present on the victim's computer.
- No public patch or fix has been confirmed by the vendor at this time.
A high severity path traversal vulnerability in PeaZip allows attackers to execute arbitrary programs on Windows systems. Security researchers have demonstrated that the flaw, tracked as CVE-2026-104025, affects all versions of the archive utility prior to 11.3.0.
What happened
The vulnerability exists within the execute_obj function of the archive object viewer, specifically in the peach.pas module. According to the National Vulnerability Database, an attacker can exploit this by crafting a malicious archive entry. The victim must be convinced to preview this entry using the "Preview with... -> Associated application" action, which corresponds to the Shift+Ctrl+O keyboard shortcut.
The defect arises because the function validates only the temporary directory name using checkfiledirname. However, the string actually executed is a concatenation of that directory and a tempstring taken directly from the archive entry name. This entry name is never validated for path traversal sequences. Consequently, an entry named with repeated parent directory references can escape the extraction directory.
The checkfiledirname routine in list_utils.pas rejects control characters but performs no check for path containment. This allows traversal sequences to pass through to the cp_open function and subsequently to ShellExecuteW. While the 7-Zip extraction backend strips these traversal sequences, the opener component does not perform this sanitisation.
Furthermore, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler. It is not present on this specific preview route. As a result, an executable inside an archive reaches the system execution handler without any warning dialog. When the prompt does fire in other contexts, it displays the entry's display name rather than the resolved path that will actually run.
Proof of concept demonstrations confirmed arbitrary code execution against official PeaZip builds. The defect was observed in both zip and tar archive formats, indicating the issue lies within PeaZip's own path handling logic rather than a single format parser. The National Vulnerability Database rates the severity of CVE-2026-104025 as high with a CVSS score of 8.4.
Why it matters
This vulnerability allows for silent code execution, meaning users receive no warning before a local program runs. Attackers can leverage this to execute programs already present on the victim's system, such as system utilities or previously installed applications. The lack of validation on the archive entry name means the extraction directory boundary is easily bypassed.
The absence of the dangerous-extension confirmation prompt on the preview route removes a key security control. Users who habitually use keyboard shortcuts for previewing files may be particularly exposed. The fact that the flaw persists across multiple archive formats suggests a fundamental issue in the application's core path handling.
What happens next
- Verify if any systems in your environment run PeaZip versions earlier than 11.3.0.
- Monitor official PeaZip channels for the release of version 11.3.0 or a security advisory.
- Restrict the use of archive preview features for untrusted files until a patch is available.
- Educate users about the risks of previewing entries from unknown sources using keyboard shortcuts.
Patch priority
Teams should immediately identify all endpoints running vulnerable versions of PeaZip. Prioritise systems with high exposure to external file transfers or email attachments. Test any available update in an isolated environment before widespread deployment to ensure stability. If no fix is available, restrict the use of preview functions for untrusted archives. Back up critical configurations before making any changes to software settings. Monitor network traffic for unusual process executions that may indicate exploitation.
What to do and how to stay safe: PeaZip
- Check your inventory for PeaZip installations and verify the version number against the affected range.
- Disable the preview feature for archive entries if your version management process is delayed.
- Monitor system logs for unexpected executions of standard system utilities or local programs.
- Wait for the vendor to release an official update before applying any unofficial patches.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of PeaZip are affected by this vulnerability?
All versions of PeaZip before 11.3.0 are affected by CVE-2026-104025.
Is there a fix available for this vulnerability?
No fix has been confirmed yet; the vulnerability affects versions before 11.3.0, implying that version may contain the fix.
How is the vulnerability exploited?
An attacker convinces a victim to preview a crafted archive entry using the "Preview with... -> Associated application" action.
