CVE-2026-104024

Name of the Vulnerable Software and Affected Versions PeaZip versions 10.5.0 through 11.2.0

Description An issue exists in the archive object viewer within the grid obj open function of peach.pas on Windows. The software uses a hard-coded list called SECEXTCONST to determine if a confirmation dialog should be shown before running a file. Because this list is incomplete and relies on exact string comparisons, it fails to account for other shell-executable and scripting-host types handled by ShellExecuteW, such as .url and .lnk files. An attacker can exploit this by convincing a user to open a crafted archive containing a Windows Internet Shortcut (.url) or a shortcut (.lnk) targeting cmd.exe with arbitrary arguments. This allows the execution of programs or commands with the privileges of the user who opened the archive, without any confirmation prompt. The shell may also resolve attacker-named UNC paths, potentially allowing the targeting of remote payloads.

Recommendations Update PeaZip to a version later than 11.2.0.