CVE-2026-105050 in PeaZip
Summary
by MITRE • 10/03/2026
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in PeaZip versions prior to 11.3.0 represents a critical security flaw rooted in improper input validation and sanitization mechanisms within the application's archive processing logic. This specific issue manifests when users attempt to open or extract archives that contain filenames with embedded quotation characters, particularly under non-default configuration settings where certain parsing behaviors are altered or enabled by default. The core technical failure lies in how the software handles strings containing quotes during command construction for underlying system operations. When a filename includes a double quote character, PeaZip fails to properly escape or neutralize this input before passing it to operating system commands. This mishandling allows an attacker who can influence the contents of an archive file to inject arbitrary shell metacharacters into the execution context of the application.
From a technical perspective, this flaw aligns with Common Weakness Enumeration category CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The vulnerability arises because the software constructs system commands by concatenating user-supplied data directly into command strings without adequate sanitization. In many archive utilities, operations such as extraction or previewing involve spawning external processes to handle file decompression or display. If the filename containing a quote is not correctly escaped, it can break out of its intended string boundary within the shell command line. This allows subsequent characters to be interpreted by the operating system's command interpreter rather than being treated as literal data part of the filename. For instance, if an archive contains a file named test".exe malicious.cmd", the resulting command might inadvertently execute malicious.cmd due to the unescaped quote terminating the original argument and allowing new commands to follow.
The operational impact of this vulnerability is severe, potentially leading to full remote code execution on affected systems under specific conditions. An attacker could craft a malicious archive containing specially designed filenames that exploit this parsing error. When an unsuspecting user opens such an archive using PeaZip with the vulnerable configuration, the injected commands execute with the privileges of the current user. This can result in data theft, installation of malware, or complete compromise of the host system depending on the context and permissions available to the application. The risk is heightened because archives are frequently exchanged between users via email, file sharing services, and other vectors that may not be thoroughly scanned for such sophisticated injection techniques before opening.
This vulnerability also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically sub-techniques involving shell commands or batch scripts depending on the operating system environment. The exploitation path typically involves social engineering tactics where a victim is persuaded to open a maliciously crafted archive file. Once executed, the injected code can perform various actions such as downloading additional payloads, exfiltrating sensitive data from the local machine, or pivoting to other systems within a network if lateral movement capabilities are present in the payload. The non-default configuration aspect suggests that while default settings might mitigate some risks through stricter parsing rules, users who customize their preferences may inadvertently expose themselves to this threat vector without realizing it.
Mitigation strategies primarily involve upgrading PeaZip to version 11.3.0 or later where these input validation issues have been addressed by the developers. Until an upgrade is possible, administrators and end-users should exercise extreme caution when opening archives from untrusted sources. It is advisable to avoid using non-default configurations that might relax security constraints unless absolutely necessary for specific workflow requirements. Additionally, employing sandboxed environments for viewing or extracting suspicious files can significantly reduce the risk of successful exploitation by isolating potential malicious code execution from the main operating system environment. Regular updates and adherence to secure configuration baselines remain essential practices in defending against such input validation vulnerabilities across all software applications handling untrusted data inputs.