PeaZip CVE-2026-104024

Exploitation requires the victim to open an attacker-crafted archive in a vulnerable PeaZip 10.5.0 through 11.2.0 on Windows and then open/launch a malicious entry (a .url Internet Shortcut or a .lnk shortcut) through the archive object viewer (grid_obj_open), because those shell-executable types are not in the seven-entry SECEXTCONST list (exe cmd msi bat ps1 vbs reg) that gates the 'Do you want to run this file?' prompt. Limiting factors that reduce real-world risk: it is Windows-only (depends on ShellExecuteW), it needs two deliberate user actions (open the archive, then open the entry), code runs only in the current user's context with no privilege escalation, and the malicious entry must use a shell-executable extension outside the disallowed list; the remote UNC-path payload variant was only attempted, not demonstrated.

This is a medium-severity, phishing-dependent code-execution flaw rather than a mass-exploitation priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) scores 4.6 and the two strongest risk dampeners are AV:L and UI:A - exploitation requires a victim to locally open a crafted archive AND then open/launch a specific entry inside PeaZip's viewer, so it is not remotely or automatically exploitable and maps to an SSVC profile of exploitation=none-observed, automatable=no, technical-impact=partial (user-context command execution, explicitly no privilege escalation). No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided in the intelligence, which is consistent with a newly disclosed, researcher-reported issue rather than active in-the-wild use. Two signals conflict with the low official score and should be weighed: the description demonstrates arbitrary command-line execution via a .lnk targeting cmd.exe, which is effectively full code execution in the user's context - I assess the impact higher (C/I/A High) than the vendor's VC:N/VI:L, meaning the practical consequence of a successful lure is more serious than 4.6 implies, even though the exploitability remains genuinely low. A patch exists, so remediation is straightforward.

An attacker crafts an archive containing a Windows Internet Shortcut (.url) or shortcut (.lnk) entry whose target/command line they control, then lures a victim (e.g. via phishing) to open it in a vulnerable PeaZip. When the victim opens that entry in the archive viewer, PeaZip passes it to ShellExecuteW without raising the 'Do you want to run this file?' prompt - because .url/.lnk are absent from the hard-coded SECEXTCONST list - executing the attacker's program or command line as the current user. The researcher describes a working proof-of-concept .lnk pointing at cmd.exe, though no public exploit code is confirmed in the provided intelligence.