Vulnerability-Lookup

GHSA-3F37-HMCF-9X56

Vulnerability from github – Published: 2026-10-15 18:32 – Updated: 2026-10-15 18:32

Details

Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

Severity

8.4 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-104025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-15T13:17:10Z",
    "severity": "HIGH"
  },
  "details": "Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -\u003e Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim\u0027s system, with no warning dialog. The function validates only outname (PeaZip\u0027s own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -\u003e ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry\u0027s display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip\u0027s own path handling and not in a single format parser.",
  "id": "GHSA-3f37-hmcf-9x56",
  "modified": "2026-10-15T18:32:33Z",
  "published": "2026-10-15T18:32:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104025"
    },
    {
      "type": "WEB",
      "url": "https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf"
    },
    {
      "type": "WEB",
      "url": "https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-104025 (GCVE-0-2026-104025)

Vulnerability from cvelistv5 – Published: 2026-10-15 12:00 – Updated: 2026-10-15 13:11 X_Open Source

Title

Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

Summary

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 13:11 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-693 - Protection Mechanism Failure

Assigner

Secur0 CNA under the INCIBE root

CNA scorecard A 99/100 over 41 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/peazip/PeaZip/commit/009fc3553…	patch
https://secur0.com/en/cna/cve-list/cve-2026-10402…	third-party-advisorytechnical-description

Impacted products

1 product

Vendor	Product	Version
PeaZip	PeaZip	Affected: 0 , < 11.3.0 (semver) cpe:2.3:a:peazip:peazip:::::::windows::

Date Public

2026-09-03 00:00

Credits

cgomezpob Dario Rivas Quero Secur0 CNA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:11:06.146482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:11:13.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/peazip/PeaZip/releases",
          "cpes": [
            "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "archive object preview/open (execute_obj in peach.pas)"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "PeaZip",
          "programFiles": [
            "peazip-sources/dev/peach.pas",
            "peazip-sources/dev/list_utils.pas"
          ],
          "programRoutines": [
            {
              "name": "execute_obj"
            },
            {
              "name": "checkfiledirname"
            }
          ],
          "repo": "https://github.com/peazip/PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThan": "11.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cgomezpob"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Dario Rivas Quero"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        }
      ],
      "datePublic": "2026-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath Traversal (CWE-22) in the \u003ccode\u003eexecute_obj\u003c/code\u003e function of the archive object viewer (\u003ccode\u003epeach.pas\u003c/code\u003e) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -\u0026gt; Associated application\" action (\u003ccode\u003eShift+Ctrl+O\u003c/code\u003e) to execute an arbitrary program already present on the victim\u0027s system, with no warning dialog. The function validates only \u003ccode\u003eoutname\u003c/code\u003e (PeaZip\u0027s own temporary directory) with \u003ccode\u003echeckfiledirname\u003c/code\u003e, while the string actually executed is the concatenation \u003ccode\u003eoutname+tempstring\u003c/code\u003e; \u003ccode\u003etempstring\u003c/code\u003e is taken verbatim from the archive entry name (\u003ccode\u003eStringGridList.Cells[12,...]\u003c/code\u003e) and is never validated. \u003ccode\u003echeckfiledirname\u003c/code\u003e (\u003ccode\u003elist_utils.pas\u003c/code\u003e) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named \u003ccode\u003e../../../../Windows/System32/calc.exe\u003c/code\u003e escapes the extraction directory and is passed to \u003ccode\u003ecp_open\u003c/code\u003e -\u0026gt; \u003ccode\u003eShellExecuteW\u003c/code\u003e; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the \u003ccode\u003eSECEXTCONST\u003c/code\u003e dangerous-extension confirmation prompt is implemented only in the double-click handler (\u003ccode\u003egrid_obj_open\u003c/code\u003e) and not on this preview route, so an executable inside an archive reaches \u003ccode\u003eShellExecuteW\u003c/code\u003e unannounced, and where the prompt does fire it names the entry\u0027s display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip\u0027s own path handling and not in a single format parser.\u003c/p\u003e"
            }
          ],
          "value": "Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -\u003e Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim\u0027s system, with no warning dialog. The function validates only outname (PeaZip\u0027s own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -\u003e ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry\u0027s display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip\u0027s own path handling and not in a single format parser."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-693",
              "description": "CWE-693 Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T12:00:49.995Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (\u003ccode\u003esanitizenamestr\u003c/code\u003e, stripping \u003ccode\u003e../\u003c/code\u003e and \u003ccode\u003e..\\\u003c/code\u003e sequences) and enforces that the resolved path stays inside the extraction directory (\u003ccode\u003esanitizepath\u003c/code\u003e, via \u003ccode\u003eExpandFileName\u003c/code\u003e containment) in \u003ccode\u003eexecute_obj\u003c/code\u003e, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit \u003ccode\u003e009fc35\u003c/code\u003e (2026-09-03).\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping ../ and ..\\ sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit 009fc35 (2026-09-03)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-104025",
    "datePublished": "2026-10-15T12:00:49.995Z",
    "dateReserved": "2026-10-01T17:09:25.587Z",
    "dateUpdated": "2026-10-15T13:11:13.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted