# CVE-2026-104025: Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name

> Attackers can execute arbitrary programs on Windows systems by tricking users into previewing crafted archive entries in PeaZip.

- **Severity:** High 8.4 (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** No
- **Published:** 15 Oct 2026
- **Updated:** 15 Oct 2026
- **Also known as:** GHSA-3f37-hmcf-9x56

## What is CVE-2026-104025?

CVE-2026-104025 is a high-severity path traversal vulnerability in PeaZip, published on 15 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.

Weakness: CWE-693 (Protection Mechanism Failure), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

## Which versions are affected by CVE-2026-104025?


## How do I fix CVE-2026-104025?

No fix has been published for CVE-2026-104025 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-104025 being exploited?

There is no known exploitation of CVE-2026-104025 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-104025 and fix it if it is affected.

What it is: CVE-2026-104025 is a high-severity path traversal vulnerability in PeaZip, published on 15 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-104025 in the wild and no public exploit code.

Affected product: PeaZip. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-104025/ (Markdown: https://insights.sbomify.com/CVE-2026-104025/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-104025
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104025
- OSV: https://osv.dev/vulnerability/CVE-2026-104025

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-104025/
Summaries are generated and may contain mistakes; the official description above is the record.