CVE-2023-6891
About
A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248251. NOTE: Vendor was contacted early, confirmed the existence of the flaw and immediately worked on a patched release.
Rainforest analyst review
PeaZip 9.4.0 has an uncontrolled search path in its dragdropfilesdll.dll library handler — a classic DLL-hijacking setup where the application can be induced to load a library from an attacker-influenced location. If a malicious DLL of the right name sits where the search path reaches it, PeaZip loads and runs it, executing code in the user's context. The attack is local, and version 9.6.0 fixes it.
The preconditions keep this firmly in the low band. An attacker must already be able to place a file where the vulnerable search path resolves — which typically means existing access to the machine or a user coaxed into extracting an archive into a booby-trapped directory. It's a local code-execution and, at most, lateral-persistence aid on a workstation, not a remote or self-propagating threat, and the vendor patched promptly on confirmation.
We treat this as routine endpoint patch hygiene rather than anything to fast-track. The relevant question is which workstations run PeaZip below 9.6.0, folded into normal software-update cadence. Given that exploitation presupposes local access or user-directed extraction into a controlled path, it ranks well beneath the network-reachable bugs in this batch — a bump to 9.6.0 closes it without special handling.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2023-6891?
A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component.
How severe is CVE-2023-6891?
CVE-2023-6891 carries a CVSS 3.1 base score of 5.3, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 51 out of 100, in the elevated band.
How is CVE-2023-6891 exploited?
According to the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L): attack vector Local, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality Low, integrity Low and availability Low.
Which products are affected by CVE-2023-6891?
Public advisories list the following as affected: peazip. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-6891?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.