Path Traversal Vulnerability in PeaZip Windows Software
CVE-2026-104025

8.4HIGH

Key Information:

Vendor

Peazip

Status
Peazip
Vendor
CVE Published:
15 October 2026

What is CVE-2026-104025?

A path traversal vulnerability exists in the execute_obj function of PeaZip, specifically affecting versions 11.2.0 and earlier on Windows. This flaw enables attackers to execute arbitrary code by tricking users into previewing manipulated archive entries. The vulnerability arises due to insufficient validation of file names, allowing paths like '../../../../Windows/System32/calc.exe' to be executed without warning. As a result, an executable embedded within an archive can run unannounced, exposing systems to potential threats. This issue has been confirmed across multiple archive formats, highlighting a significant security concern in PeaZip's handling of file paths.

Affected Version(s)

PeaZip Windows 0 < 11.3.0

References

https://github.com/peazip/PeaZip/commit/009fc35530e267298...
patch
https://secur0.com/en/cna/cve-list/cve-2026-104025-path-t...
third-party-advisorytechnical-description

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cgomezpob
Dario Rivas Quero
Secur0 CNA
.