# CVE-2026-104024: PeaZip incomplete dangerous-extension check in archive viewer

Source: https://junglewise.ai/threats/cve-2026-104024-incomplete-list-of-disallowed-inputs-cwe-184-in-the-dangerous  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104024 · Severity: info · Published 2026-10-15

PeaZip is a file archiving and extraction utility for Windows. The application fails to properly validate file extensions before executing files extracted from archives, allowing an attacker to craft a malicious archive with files bearing executable extensions like .url or .lnk that bypass the safety confirmation dialog. When a user opens such a crafted archive, arbitrary programs or commands can execute without user consent.

Technologies: [PeaZip](https://junglewise.ai/threats/technologies/peazip). Vendors: [PeaZip](https://junglewise.ai/threats/vendors/peazip).

## Quick answers

**Is CVE-2026-104024 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104024 being exploited in the wild.

**How severe is CVE-2026-104024?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** PeaZip 10.5.0 through 11.2.0 on Windows.

**Is there a fix for CVE-2026-104024?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104024 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-104024?** Check whether you run PeaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incomplete allowlist (CWE-184) in the dangerous-extension confirmation logic (peach.pas, grid_obj_open). The check uses exact string comparison against a hardcoded list of seven extensions (exe, cmd, msi, bat, ps1, vbs, reg), missing shell-executable types like .url and .lnk that Windows will execute via ShellExecuteW. A .url entry with attacker-controlled URL launches without prompting; a .lnk entry can execute arbitrary commands with arguments, including UNC paths for remote payload delivery.

## Affected products

- PeaZip PeaZip 10.5.0 through 11.2.0 on Windows

## Timeline

- 2026-10-15: disclosed

## Related threats

- [PeaZip path traversal in archive object viewer](https://junglewise.ai/threats/cve-2026-104025-path-traversal-cwe-22-in-the-execute-obj-function-of-the-archive)
- [PeaZip command injection via archive filename in non-default configuration](https://junglewise.ai/threats/cve-2026-105050-peazip-before-11-3-0-in-a-non-default-configuration-is)
- [PeaZip out-of-bounds write in PEA archive extraction](https://junglewise.ai/threats/cve-2026-102514-out-of-bounds-write-cwe-787-in-the-pea-archive-extraction)