PeaZip vulnerabilities

An Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer in PeaZip 10.5.0 through 11.2.0 on Windows affects how risky file types are handled. The SECEXTCONST list contains only seven extensions (exe, cmd, msi, bat, ps1, vbs, reg) and the check is an exact string comparison, so it misses other types executed via ShellExecuteW, including .url and .lnk. As a result, opening a crafted archive entry can execute a program or arbitrary command with no confirmation dialog.

A Path Traversal (CWE-22) vulnerability in the execute_obj function of PeaZip's archive object viewer (peach.pas) in versions 11.2.0 and earlier on Windows allows an attacker to execute an arbitrary program already present on the victim's system. The attacker must convince the victim to preview a crafted archive entry via the "Preview with... -> Associated application" action (Shift+Ctrl+O), where the entry name contains "../" sequences that escape the temporary extraction directory and are passed to ShellExecuteW without warning. The flaw stems from missing validation of the tempstring and lack of path-containment check in checkfiledirname.

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.

Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip.