PeaZip: Path traversal in object preview allows execution of programs
Summary
PeaZip for Windows up to version 11.2.0 does not properly validate archive entry names when an entry is previewed via 'Open/Preview with associated application' (Shift+Ctrl+O). A crafted archive entry with repeated ../ segments can point to a program already present on the victim's system, which is then started without a warning dialog. Exploitation requires that a victim opens a malicious archive and previews the entry; the attack is local and the impact is limited to the user's context.
Affected
- PeaZip for Windows 11.2.0 and earlier (CNA range: all versions before 11.3.0)
- Default status: affected
Fixed in
- Upgrade to PeaZip 11.3.0 or later
- PeaZip 11.4.0 is the current release at the time of writing
Workaround
- No vendor-documented workaround known.
- Do not use Preview or 'Open with associated application' on archives from untrusted senders or websites.
- Extract such archives to a sandbox or non-production folder first.
Exploitation
- No evidence of exploitation in the wild is known.
- The CNA reports a proof of concept against official PeaZip builds; public availability of the PoC is unknown.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.00159.
Our recommendation
- Update PeaZip on all Windows workstations to version 11.3.0 or later, preferably 11.4.0.
- Check the software inventory for PeaZip installations, including portable copies.
- Until patched, avoid previewing entries from untrusted archives.
- Monitor for unexpected program launches following archive handling.
- Note the scoring difference: CNA CVSS 4.0 is 8.4, VulDB lists 4.8.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record by Secur0 CNA secur0.com
- Fix commit 009fc35 on GitHub github.com
- PeaZip 11.3.0 release github.com
- PeaZip 11.4.0 release github.com
- VulDB entry 420619 vuldb.com
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:23.
Original description (NVD)
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.