{"api_version":"1","generated_at":"2026-10-22T04:55:42+00:00","cve":"CVE-2026-104025","urls":{"html":"https://cve.report/CVE-2026-104025","api":"https://cve.report/api/cve/CVE-2026-104025.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-104025","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-104025"},"summary":{"title":"Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name","description":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -> Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.","state":"PUBLISHED","assigner":"Secur0","published_at":"2026-10-15 13:17:10","updated_at":"2026-10-16 19:56:15"},"problem_types":["CWE-22","CWE-693","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-693 CWE-693 Protection Mechanism Failure"],"metrics":[{"version":"4.0","source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","score":"8.4","severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.4","severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.4,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf","name":"https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf","refsource":"4daa8cea-433a-44bd-9456-53b127fc289a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview","name":"https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview","refsource":"4daa8cea-433a-44bd-9456-53b127fc289a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104025","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104025","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"PeaZip","product":"PeaZip","version":"affected 11.3.0 semver","platforms":["Windows"]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping ../ and ..\\ sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit 009fc35 (2026-09-03).","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"cgomezpob","lang":"en"},{"source":"CNA","value":"Dario Rivas Quero","lang":"en"},{"source":"CNA","value":"Secur0 CNA","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"104025","cve":"CVE-2026-104025","epss":"0.001590000","percentile":"0.046350000","score_date":"2026-10-16","updated_at":"2026-10-17 00:14:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-104025","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T13:11:06.146482Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T13:11:13.654Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://github.com/peazip/PeaZip/releases","cpes":["cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"],"defaultStatus":"unaffected","modules":["archive object preview/open (execute_obj in peach.pas)"],"platforms":["Windows"],"product":"PeaZip","programFiles":["peazip-sources/dev/peach.pas","peazip-sources/dev/list_utils.pas"],"programRoutines":[{"name":"execute_obj"},{"name":"checkfiledirname"}],"repo":"https://github.com/peazip/PeaZip","vendor":"PeaZip","versions":[{"lessThan":"11.3.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"cgomezpob"},{"lang":"en","type":"analyst","value":"Dario Rivas Quero"},{"lang":"en","type":"coordinator","value":"Secur0 CNA"}],"datePublic":"2026-09-03T00:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Path Traversal (CWE-22) in the <code>execute_obj</code> function of the archive object viewer (<code>peach.pas</code>) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -&gt; Associated application\" action (<code>Shift+Ctrl+O</code>) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only <code>outname</code> (PeaZip's own temporary directory) with <code>checkfiledirname</code>, while the string actually executed is the concatenation <code>outname+tempstring</code>; <code>tempstring</code> is taken verbatim from the archive entry name (<code>StringGridList.Cells[12,...]</code>) and is never validated. <code>checkfiledirname</code> (<code>list_utils.pas</code>) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named <code>../../../../Windows/System32/calc.exe</code> escapes the extraction directory and is passed to <code>cp_open</code> -&gt; <code>ShellExecuteW</code>; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the <code>SECEXTCONST</code> dangerous-extension confirmation prompt is implemented only in the double-click handler (<code>grid_obj_open</code>) and not on this preview route, so an executable inside an archive reaches <code>ShellExecuteW</code> unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.</p>"}],"value":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -> Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser."}],"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.4,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"},{"cweId":"CWE-693","description":"CWE-693 Protection Mechanism Failure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-15T12:00:49.995Z","orgId":"4daa8cea-433a-44bd-9456-53b127fc289a","shortName":"Secur0"},"references":[{"tags":["patch"],"url":"https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf"},{"tags":["third-party-advisory","technical-description"],"url":"https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (<code>sanitizenamestr</code>, stripping <code>../</code> and <code>..\\</code> sequences) and enforces that the resolved path stays inside the extraction directory (<code>sanitizepath</code>, via <code>ExpandFileName</code> containment) in <code>execute_obj</code>, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit <code>009fc35</code> (2026-09-03).</p>"}],"value":"Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping ../ and ..\\ sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit 009fc35 (2026-09-03)."}],"source":{"discovery":"EXTERNAL"},"tags":["x_open-source"],"title":"Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"4daa8cea-433a-44bd-9456-53b127fc289a","assignerShortName":"Secur0","cveId":"CVE-2026-104025","datePublished":"2026-10-15T12:00:49.995Z","dateReserved":"2026-10-01T17:09:25.587Z","dateUpdated":"2026-10-15T13:11:13.654Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-15 13:17:10","lastModifiedDate":"2026-10-16 19:56:15","problem_types":["CWE-22","CWE-693","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","CWE-693 CWE-693 Protection Mechanism Failure"],"metrics":{"cvssMetricV40":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T13:11:06.146482Z","id":"CVE-2026-104025","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"104025","Ordinal":"1","Title":"Path traversal in PeaZip object preview allows execution of arbi","CVE":"CVE-2026-104025","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"104025","Ordinal":"1","NoteData":"Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -> Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.","Type":"Description","Title":"Path traversal in PeaZip object preview allows execution of arbi"}]}}}