EUVD-2026-102023
GHSA-3f37-hmcf-9x56
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted .zip/.tar archive to victim
-
DeliveryVictim opens archive in PeaZip
-
ExploitVictim selects Preview with Associated application
-
ExecutionTraversal escapes temp directory unvalidated
-
ImpactShellExecuteW runs target executable silently
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open an attacker-crafted archive in PeaZip (11.2.0 or earlier on Windows) and specifically invoke the 'Preview with... -> Associated application' action (Shift+Ctrl+O) on a malicious entry; normal double-click opening is NOT affected because the SECEXTCONST dangerous-extension prompt only guards grid_obj_open, not this preview route. The malicious archive entry name must contain a path-traversal sequence (e.g. ../../../../Windows/System32/calc.exe) that resolves to an executable already present on the victim's filesystem - the flaw launches existing programs, it does not drop new binaries. Limiting factors: mandatory multi-step user interaction (UI:A), local delivery of the file, and dependence on a target executable existing at the resolved path; no authentication or elevated privileges are required. |
| Impact | This is a genuine but interaction-gated local code-execution flaw rather than a mass-exploitable remote bug. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.4 and is internally consistent with the description: no privileges are needed (PR:N, so unauthenticated in CVSS terms), complexity is low, but Active user interaction (UI:A) is mandatory - the victim must open a crafted archive and manually trigger 'Preview with... -> Associated application' (Shift+Ctrl+O). The local attack vector (AV:L) correctly reflects that the attacker does not touch the network directly; delivery is social-engineering of a file. A proof of concept against official PeaZip builds is confirmed across two formats (.zip and .tar), so exploitability is demonstrated, not theoretical - publicly available exploit code exists. However, no EPSS score was provided and there is no CISA KEV listing in the input, so there is no evidence of active in-the-wild exploitation; the signals point to a credible, low-complexity technique that nonetheless depends on a non-default, multi-step user action. Net: a real priority for PeaZip users to patch, but its practical reach is limited by the required deliberate preview action and the fact that it only executes programs already present on the victim's system, moderating the raw 8.4. |
| Exploit ScenarioDerived | An attacker emails or hosts a crafted .zip or .tar archive containing an entry named like ../../../../Windows/System32/calc.exe and lures the victim into opening it in PeaZip and choosing 'Preview with... -> Associated application' (Shift+Ctrl+O). Because the traversal escapes PeaZip's temp directory and the dangerous-extension prompt never fires on this route, ShellExecuteW launches the targeted executable with no warning. A working proof of concept against official PeaZip builds has been demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Path traversal in PeaZip's archive object preview handler allows a crafted archive entry to escape the extraction directory and be handed directly to ShellExecuteW, so a victim who opens a malicious archive on Windows and invokes 'Preview with... -> Associated application' (Shift+Ctrl+O) on the rogue entry can be made to launch an arbitrary program already present on their system without the usual dangerous-extension warning. Affected are PeaZip 11.2.0 and earlier on Windows; no authentication or elevated privileges are needed, but exploitation is interaction-gated (local file delivery plus a deliberate multi-step preview action, CVSS 4.0 base 8.4 with AV:L/UI:A/PR:N and high C/I/A impact). A proof of concept was demonstrated against official vendor builds on two archive formats (.zip and .tar), confirming the defect is in PeaZip's own path handling rather than a single format parser; no CISA KEV entry or independent confirmation of active exploitation was reported at time of analysis. The practical limitation is that the flaw launches programs that already exist at the resolved path (for example a system binary) rather than dropping new attacker-supplied binaries.
RemediationAI
Vendor patching is available through the upstream fix commit 009fc35530e26729863969eddf4c18f1b48331cf (https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf), which adds canonical-path containment via sanitizepath/ExpandFileName, strips '../' sequences through sanitizenamestr, and introduces a rejection marker enforced by validatecl; the input data lists the patch as vendor-available but does not name a tagged release version, so treat this as 'Upstream fix available (PR/commit); released patched version not independently confirmed' and verify the current PeaZip download for Windows is built from the fixed sources before relying on it. Until a patched build is confirmed, the highest-value compensating control is behavioural: never use the Shift+Ctrl+O 'Preview with... -> Associated application' action on archives that are not fully trusted, since normal double-click opening is guarded by the SECEXTCONST prompt that this route bypasses, and note the trade-off is simply that preview-via-associated-application functionality becomes unavailable. Additional controls with their caveats: open untrusted archives only inside a sandbox or low-privilege user context whose reachable absolute paths contain no useful executables, acknowledging this is incomplete because any executable present at a traversable path can still be launched; avoid extracting and previewing archives received via email or downloaded from the web; and monitor for unexpected ShellExecuteW-driven child processes (e.g. system binaries spawned by PeaZip) as a detection signal, accepting that such monitoring is probabilistic and not a preventive measure. Keep in mind that installing a newer PeaZip removes the root cause entirely, so it should remain the primary fix rather than the workarounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic path-traversal / improper path-equivalence issue (CWE-22) in the object preview pipeline of PeaZip's archive viewer (peach.pas). PeaZip extracts archive contents into its own temporary directory (referred to as outname) and then launches the previewed file via cp_open, which on Windows ends in ShellExecuteW. The execute_obj function validates only outname with checkfiledirname, while the string actually executed is the concatenation outname+tempstring. tempstring is taken verbatim from the archive entry name as displayed in StringGridList.Cells[12,...] and is never validated. checkfiledirname (list_utils.pas) rejects control characters and Windows-reserved names and characters but performs no '..' path-containment check, so an entry named ../../../../Windows/System32/calc.exe resolves outside the temporary directory. The asymmetry that makes this reachable is that the 7-Zip extraction backend does strip the traversal sequence when writing the file (so the file lands safely inside the temp directory), while the opener does not - the traversal string is preserved in the entry metadata and re-used verbatim for the launch. A second defect compounds the first: the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and even where the prompt fires it names the entry's display name rather than the resolved path that will actually run. The upstream fix commit 009fc35530e26729863969eddf4c18f1b48331cf adds sanitizenamestr (stripping '../', '..\' and '..'+DirectorySeparator), a sanitizepath routine that expands s0+s1 with ExpandFileName and rejects the result unless the canonical path still begins with the expected base (POS(s0,s)<>1), a wintrailing check for trailing space/dot on Windows, replacespecialpathchars for reserved path characters, a validatecl_console hardening routine, and an '#invalid string#' rejection marker that makes validatecl discard any command line whose sanitization failed.
Know when Peazip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
User must deliberately trigger the preview action so UI:R and AV:L; no auth needed so PR:N; arbitrary program execution yields full C/I/A impact within the user's context.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
DescriptionCVE.org
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Articles & Coverage 1
Executive ViewAI
PeaZip 11.2.0 and earlier on Windows ship with a path-traversal defect in the archive preview handler that lets a crafted archive entry escape the intended extraction directory and be passed to the operating system's program-launching interface. A user who opens a malicious archive and performs a routine multi-step preview action can be induced to start an unintended executable already resident on their endpoint, bypassing the normal unsafe-file-extension warning. Publicly available exploit code exists, and because no credentials or administrative rights are required, any Windows user who handles untrusted archives - including finance, HR, and IT staff receiving files from outside the organization - represents the exposure surface that leadership should weigh.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag functio
Out-of-bounds write in PeaZip's PEA archive extractor allows an attacker to execute arbitrary code with the privileges o
A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Rated high severity (CVSS 7.8), this vulne
OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embed
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. Rated medium severity (CVSS 6.1), this vulner
PeaZip 10.5.0 through 11.2.0 on Windows fails to show its 'Do you want to run this file?' confirmation before launching
Exploit-DB