PT-2025-16365 · Peazip · Peazip

Enis Aksu · Published 2025-04-15 · Updated 2025-10-24 · CVE-2025-33026

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PeaZip versions 10.4.0 and earlier

Description This issue allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this to execute arbitrary code in the context of the current user.

Recommendations For PeaZip versions 10.4.0 and earlier, consider disabling the archive extraction feature until a patch is available. Restrict access to potentially malicious archives to minimize the risk of exploitation. Avoid opening files from untrusted sources to reduce the risk of executing arbitrary code. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-830

CWE-829

Related Identifiers

CVE-2025-33026

Affected Products

Peazip

References · 8

• 🔥 https://github.com/EnisAksu/Argonis/blob/main/CVEs/CVE-2025-33026%20%28PeaZip%29/CVE-2025-33026.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-33026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-33026 · Security Note
• https://t.me/cveNotify/140285 · Telegram Post
• https://twitter.com/CVEnew/status/1912201814847725969 · Twitter Post
• https://t.me/cvedetector/22982 · Telegram Post
• https://peazip.github.io/peazip-64bit.html · Note
• https://twitter.com/VulmonFeeds/status/1912257573996179507 · Twitter Post