Approved changes feed: RSS · Atom
cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Peazip (86340147-b539-5723-a341-0d3743b5d6b9) |
|---|---|
| Product | Peazip (4dccbf78-dfc8-5856-aabf-b1514470acdb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/peazip/peazip |
purl2cpe | 2026-06-01 10:12:24.051312 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-33026 |
vulnerable | 2026-06-08 07:19:01.398645 |
Details available
MEDIUM (6.1)
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, PeaZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
Published: 2025-04-15T00:00:00.000Z
Updated: 2025-10-24T19:20:48.751Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.