CVE-2023-6891 - PeaZip Library dragdropfilesdll.dll uncontrolled search path

Back Back to CVE browser

HIGH

PeaZip Library dragdropfilesdll.dll uncontrolled search path

Published Dec 17, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.30%

Description

A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248251. NOTE: Vendor was contacted early, confirmed the existence of the flaw and immediately worked on a patched release.

Affected products

Vendor n/a Product PeaZip Default
n/a
- Version
  9.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

PeaZip

n/a

Version	Status	Constraints
9.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-427

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59092
Advisory
https://peazip.github.io/changelog.html
patchrelease-notesRelease Notes
https://vuldb.com/?ctiid.248251
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.248251
vdb-entryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59092		Advisory
https://peazip.github.io/changelog.html		patchrelease-notesRelease Notes
https://vuldb.com/?ctiid.248251		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.248251		vdb-entryThird Party Advisory