{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104024",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:46:46.102565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:47:51.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/peazip/PeaZip/releases",
          "cpes": [
            "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "archive object open/preview (grid_obj_open in peach.pas)"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "PeaZip",
          "programFiles": [
            "peazip-sources/dev/peach.pas"
          ],
          "programRoutines": [
            {
              "name": "grid_obj_open"
            }
          ],
          "repo": "https://github.com/peazip/PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThan": "11.3.0",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cgomezpob"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Dario Rivas Quero"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        }
      ],
      "datePublic": "2026-08-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (\u003ccode\u003epeach.pas\u003c/code\u003e, \u003ccode\u003egrid_obj_open\u003c/code\u003e) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary command, with no confirmation dialog. The prompt (Do you want to run this file?) is gated by \u003ccode\u003eSECEXTCONST\u003c/code\u003e, a hard-coded list of seven extensions (\u003ccode\u003eexe cmd msi bat ps1 vbs reg\u003c/code\u003e); the check is an exact string comparison of the entry extension against that list, so it answers only whether the extension is one of the seven and never whether the shell will execute the file. Shell-executable and scripting-host types that Windows runs through \u003ccode\u003eShellExecuteW\u003c/code\u003e are absent from the list, among them \u003ccode\u003e.url\u003c/code\u003e and \u003ccode\u003e.lnk\u003c/code\u003e. An archived Windows Internet Shortcut (\u003ccode\u003e.url\u003c/code\u003e) whose URL line is attacker-controlled is launched with no prompt, while the byte-identical content in an entry named \u003ccode\u003e.bat\u003c/code\u003e does raise the warning in the same session. A \u003ccode\u003e.lnk\u003c/code\u003e entry raises the ceiling from launching a program to running a command line, because a Windows shortcut carries arguments: a proof-of-concept shortcut targeting \u003ccode\u003ecmd.exe\u003c/code\u003e with an attacker-chosen command line executed with no prompt. The shortcut target is not confined to the local disk; the shell also resolved an attacker-named UNC path (fetching a remote payload was only attempted, not demonstrated). No privilege escalation; everything runs as the user who opened the archive.\u003c/p\u003e"
            }
          ],
          "value": "Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary command, with no confirmation dialog. The prompt (Do you want to run this file?) is gated by SECEXTCONST, a hard-coded list of seven extensions (exe cmd msi bat ps1 vbs reg); the check is an exact string comparison of the entry extension against that list, so it answers only whether the extension is one of the seven and never whether the shell will execute the file. Shell-executable and scripting-host types that Windows runs through ShellExecuteW are absent from the list, among them .url and .lnk. An archived Windows Internet Shortcut (.url) whose URL line is attacker-controlled is launched with no prompt, while the byte-identical content in an entry named .bat does raise the warning in the same session. A .lnk entry raises the ceiling from launching a program to running a command line, because a Windows shortcut carries arguments: a proof-of-concept shortcut targeting cmd.exe with an attacker-chosen command line executed with no prompt. The shortcut target is not confined to the local disk; the shell also resolved an attacker-named UNC path (fetching a remote payload was only attempted, not demonstrated). No privilege escalation; everything runs as the user who opened the archive."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-165",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-165 File Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184 Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-693",
              "description": "CWE-693 Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T13:30:13.885Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/commit/90ddbaee0945a4d8ffa4d972d43711bbfb9576ba"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-104024-incomplete-extension-list-in-peazip"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to PeaZip 11.3.0 or higher. The fix extends the dangerous-extension list to cover shell-executable and scripting-host types (among them \u003ccode\u003e.url\u003c/code\u003e and \u003ccode\u003e.lnk\u003c/code\u003e) so the confirmation prompt is raised for them as well, and applies the check to the open/preview-with-associated-application route in addition to the double-click handler. Fix commit \u003ccode\u003e90ddbae\u003c/code\u003e (2026-08-27).\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to PeaZip 11.3.0 or higher. The fix extends the dangerous-extension list to cover shell-executable and scripting-host types (among them .url and .lnk) so the confirmation prompt is raised for them as well, and applies the check to the open/preview-with-associated-application route in addition to the double-click handler. Fix commit 90ddbae (2026-08-27)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-104024",
    "datePublished": "2026-10-15T13:30:13.885Z",
    "dateReserved": "2026-10-01T17:09:24.332Z",
    "dateUpdated": "2026-10-16T18:47:51.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:11:06.146482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:11:13.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/peazip/PeaZip/releases",
          "cpes": [
            "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "archive object preview/open (execute_obj in peach.pas)"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "PeaZip",
          "programFiles": [
            "peazip-sources/dev/peach.pas",
            "peazip-sources/dev/list_utils.pas"
          ],
          "programRoutines": [
            {
              "name": "execute_obj"
            },
            {
              "name": "checkfiledirname"
            }
          ],
          "repo": "https://github.com/peazip/PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThan": "11.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cgomezpob"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Dario Rivas Quero"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        }
      ],
      "datePublic": "2026-09-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath Traversal (CWE-22) in the \u003ccode\u003eexecute_obj\u003c/code\u003e function of the archive object viewer (\u003ccode\u003epeach.pas\u003c/code\u003e) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -\u0026gt; Associated application\" action (\u003ccode\u003eShift+Ctrl+O\u003c/code\u003e) to execute an arbitrary program already present on the victim\u0027s system, with no warning dialog. The function validates only \u003ccode\u003eoutname\u003c/code\u003e (PeaZip\u0027s own temporary directory) with \u003ccode\u003echeckfiledirname\u003c/code\u003e, while the string actually executed is the concatenation \u003ccode\u003eoutname+tempstring\u003c/code\u003e; \u003ccode\u003etempstring\u003c/code\u003e is taken verbatim from the archive entry name (\u003ccode\u003eStringGridList.Cells[12,...]\u003c/code\u003e) and is never validated. \u003ccode\u003echeckfiledirname\u003c/code\u003e (\u003ccode\u003elist_utils.pas\u003c/code\u003e) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named \u003ccode\u003e../../../../Windows/System32/calc.exe\u003c/code\u003e escapes the extraction directory and is passed to \u003ccode\u003ecp_open\u003c/code\u003e -\u0026gt; \u003ccode\u003eShellExecuteW\u003c/code\u003e; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the \u003ccode\u003eSECEXTCONST\u003c/code\u003e dangerous-extension confirmation prompt is implemented only in the double-click handler (\u003ccode\u003egrid_obj_open\u003c/code\u003e) and not on this preview route, so an executable inside an archive reaches \u003ccode\u003eShellExecuteW\u003c/code\u003e unannounced, and where the prompt does fire it names the entry\u0027s display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip\u0027s own path handling and not in a single format parser.\u003c/p\u003e"
            }
          ],
          "value": "Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the \"Preview with... -\u003e Associated application\" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim\u0027s system, with no warning dialog. The function validates only outname (PeaZip\u0027s own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no \"..\" path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -\u003e ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry\u0027s display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip\u0027s own path handling and not in a single format parser."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-693",
              "description": "CWE-693 Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T12:00:49.995Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-104025-path-traversal-in-peazip-object-preview"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (\u003ccode\u003esanitizenamestr\u003c/code\u003e, stripping \u003ccode\u003e../\u003c/code\u003e and \u003ccode\u003e..\\\u003c/code\u003e sequences) and enforces that the resolved path stays inside the extraction directory (\u003ccode\u003esanitizepath\u003c/code\u003e, via \u003ccode\u003eExpandFileName\u003c/code\u003e containment) in \u003ccode\u003eexecute_obj\u003c/code\u003e, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit \u003ccode\u003e009fc35\u003c/code\u003e (2026-09-03).\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to PeaZip 11.3.0 or higher. The fix sanitizes the archive entry name used to build the executed path (sanitizenamestr, stripping ../ and ..\\ sequences) and enforces that the resolved path stays inside the extraction directory (sanitizepath, via ExpandFileName containment) in execute_obj, and extends the dangerous-extension check to the \"Open/Preview with associated application\" route, not only the double-click event. Fix commit 009fc35 (2026-09-03)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-104025",
    "datePublished": "2026-10-15T12:00:49.995Z",
    "dateReserved": "2026-10-01T17:09:25.587Z",
    "dateUpdated": "2026-10-15T13:11:13.654Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105050",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:59:24.486320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:42:13.608Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PeaZip",
          "programFiles": [
            "peazip-sources/dev/list_utils.pas"
          ],
          "programRoutines": [
            {
              "name": "stringdelim"
            },
            {
              "name": "correctdelimiter"
            }
          ],
          "repo": "https://github.com/peazip/PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThan": "11.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because \"quotation character already used in the string\" is mishandled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T22:37:54.551Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/releases/tag/11.3.0"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/tree/sources/peazip-sources"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://app.secur0.com/certificate/ys3yqg-avrwaq-5ybnwl"
        },
        {
          "url": "https://github.com/peazip/PeaZip/commit/009fc35530e26729863969eddf4c18f1b48331cf"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-105050",
    "datePublished": "2026-10-02T22:37:54.551Z",
    "dateReserved": "2026-10-02T22:37:53.599Z",
    "dateUpdated": "2026-10-06T17:42:13.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102514",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T20:24:09.150452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T20:24:18.718Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/peazip/PeaZip/releases",
          "cpes": [
            "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "PEA archive extractor (pea component)"
          ],
          "platforms": [
            "Windows",
            "macOS",
            "Linux",
            "BSD"
          ],
          "product": "PeaZip",
          "programFiles": [
            "peazip-sources/dev/pea.pas"
          ],
          "programRoutines": [
            {
              "name": "unpea_procedure"
            }
          ],
          "repo": "https://github.com/peazip/PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThan": "11.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "julichaan"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "c4sh3r"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Dario Rivas Quero"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        }
      ],
      "datePublic": "2026-08-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOut-of-bounds Write (CWE-787) in the PEA archive extraction routine (\u003ccode\u003epea.pas\u003c/code\u003e, \u003ccode\u003eunpea_procedure\u003c/code\u003e) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While decompressing a \u003ccode\u003ePCOMPRESS1\u003c/code\u003e stream, the 32-bit compressed-block-size field of the first block (\u003ccode\u003ecompsize\u003c/code\u003e) is read directly from the archive and used without validation as the length of a \u003ccode\u003eblockread\u003c/code\u003e into the fixed-size global buffers \u003ccode\u003ewbuf1/wbuf2\u003c/code\u003e (1,114,112 bytes) and as the bound of the subsequent copy loop. The existing check \"\u003ccode\u003ecompsize\u003c/code\u003e \u0026gt; WBUFSIZE\" is applied only to the size of each following block, so the first block escapes it; the same unvalidated value is also used to index wbuf1[\u003ccode\u003ecompsize\u003c/code\u003e], an out-of-bounds read at an attacker-chosen offset. The copy loop additionally copies the requested length instead of the number of bytes actually read, and terminates on equality rather than on an upper bound. Because the project is built without range checking and no archive password, integrity tag or non-default configuration is required, the overflow overwrites adjacent global data; code execution was demonstrated by two independent researchers against the official Linux x86-64 and Windows x64 builds, and the denial-of-service and memory-corruption primitive is cross-platform (Windows, macOS, Linux, BSD).\u003c/p\u003e"
            }
          ],
          "value": "Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While decompressing a PCOMPRESS1 stream, the 32-bit compressed-block-size field of the first block (compsize) is read directly from the archive and used without validation as the length of a blockread into the fixed-size global buffers wbuf1/wbuf2 (1,114,112 bytes) and as the bound of the subsequent copy loop. The existing check \"compsize \u003e WBUFSIZE\" is applied only to the size of each following block, so the first block escapes it; the same unvalidated value is also used to index wbuf1[compsize], an out-of-bounds read at an attacker-chosen offset. The copy loop additionally copies the requested length instead of the number of bytes actually read, and terminates on equality rather than on an upper bound. Because the project is built without range checking and no archive password, integrity tag or non-default configuration is required, the overflow overwrites adjacent global data; code execution was demonstrated by two independent researchers against the official Linux x86-64 and Windows x64 builds, and the denial-of-service and memory-corruption primitive is cross-platform (Windows, macOS, Linux, BSD)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T16:50:59.674Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/peazip/PeaZip/commit/90ddbaee0945a4d8ffa4d972d43711bbfb9576ba"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-102514-out-of-bounds-write-in-peazip-pea-extractor"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to PeaZip 11.3.0 or higher, which validates the size of the first compressed block (commit \u003ccode\u003e90ddbae\u003c/code\u003e), copies the number of bytes actually read, and stops the block-reading loop when the address exceeds the expected value.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to PeaZip 11.3.0 or higher, which validates the size of the first compressed block (commit 90ddbae), copies the number of bytes actually read, and stops the block-reading loop when the address exceeds the expected value."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-102514",
    "datePublished": "2026-10-01T20:00:51.760Z",
    "dateReserved": "2026-09-29T11:56:57.709Z",
    "dateUpdated": "2026-10-14T16:50:59.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-33026",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-15T17:51:47.480237Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T17:52:04.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PeaZip",
          "vendor": "PeaZip",
          "versions": [
            {
              "lessThanOrEqual": "10.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "10.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file\u0027s content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-830",
              "description": "CWE-830 Inclusion of Web Functionality from an Untrusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-24T19:20:48.751Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://peazip.github.io/peazip-64bit.html"
        },
        {
          "url": "https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-33026",
    "datePublished": "2025-04-15T00:00:00.000Z",
    "dateReserved": "2025-04-15T00:00:00.000Z",
    "dateUpdated": "2025-10-24T19:20:48.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}