PeaZip CVE-2026-105050

Exploitation requires PeaZip running in an unspecified NON-DEFAULT configuration (the description explicitly scopes the flaw to such setups, so default installs are not affected), plus local user interaction: the victim must open or process an attacker-supplied archive. The attacker must craft a filename inside the archive that triggers the specific 'quotation character already used in the string' mishandling (reflected as AT:P in the CVSS 4.0 vector). Limiting factors: local attack vector (AV:L), required victim action (UI:A), dependence on a non-default setting, and the need to win the filename-quoting condition - together these substantially constrain real-world exploitability despite the high code-execution impact. Affected versions: all PeaZip releases before 11.3.0.

This is a moderate-priority issue that should be patched but does not warrant emergency response. The authoritative CVSS 4.0 vector (7.1) is internally consistent with the description: AV:L and UI:A mean the victim must locally open or interact with a malicious archive, and AT:P reflects the specific precondition that a filename contain a quotation character that is mishandled - this is not drive-by remote exploitation. The description's explicit 'non-default configuration' qualifier is a significant risk reducer that the CVSS vector only partially captures (via AT:P), meaning the vulnerable code path is not reachable in stock PeaZip installs. No EPSS score, KEV listing, SSVC decision, or POC was provided in the intelligence, so exploitation probability signals are absent rather than low - do not read the missing EPSS as 'safe.' The high VC/VI/VA (command injection yielding code execution) means technical impact is severe IF the preconditions are met, but the combination of local vector, required user interaction, non-default config, and a filename-crafting requirement makes mass or automated exploitation unlikely. Net: genuine but conditional risk, best characterized as targeted/social-engineering-dependent rather than wormable.

An attacker crafts an archive containing a file whose name embeds OS command syntax exploiting the mishandled 'quotation character already used in the string' condition, then delivers it to a victim running PeaZip in the specific non-default configuration. When the victim opens or processes the archive, the malformed filename is passed to a shell and the attacker's commands execute with the victim's privileges. No public exploit code was identified in the provided intelligence, so this scenario is inferred from the description and CVSS vector.