Incomplete Input Validation in PeaZip Archive Viewer

CVE-2026-104024

What is CVE-2026-104024?

In PeaZip versions 10.5.0 through 11.2.0, an incomplete list of disallowed input extensions allows attackers to execute arbitrary commands without user confirmation. When a user opens a crafted archive, the security prompt intended to warn them is bypassed for certain file types, including Windows Internet Shortcuts (.url) and shortcuts (.lnk). These vulnerable file types can execute commands with arguments specified by the attacker, thus enhancing the potential for exploitation. The vulnerability indicates that not all executable formats are sufficiently checked, leading to considerable risks when handling untrusted archives.

References