CVE-2026-104024 Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation

[
  {
    "vendor": "PeaZip",
    "product": "PeaZip",
    "platforms": [
      "Windows"
    ],
    "collectionURL": "https://github.com/peazip/PeaZip/releases",
    "repo": "https://github.com/peazip/PeaZip",
    "modules": [
      "archive object open/preview (grid_obj_open in peach.pas)"
    ],
    "programFiles": [
      "peazip-sources/dev/peach.pas"
    ],
    "programRoutines": [
      {
        "name": "grid_obj_open"
      }
    ],
    "versions": [
      {
        "status": "affected",
        "version": "10.5.0",
        "lessThan": "11.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:2.3:a:peazip:peazip:*:*:*:*:*:*:windows:*:*"
    ]
  }
]