Weakness (CWE)
CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
More detail
Some of the most common variants of untrusted search path are:
- In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library. Programming languages may have their own paths for locating code, e.g. PERL5LIB in Perl.
- In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
Source: MITRE CWE-426
366 results · Feed
-
High 7.8
draw.io Desktop allows Windows executable search-path hijacking
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Exp…
-
High 7.5
pgAdmin 4: Utility binary path can point at a shared storage directory
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory…
-
Medium 6.9
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory.…
-
High 7.3
A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by …
-
Medium 5.2
mk-oracle: Local privilege escalation via insecure Oracle Home library loading
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' pl…
-
Critical 10.0
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via suppl…
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. Th…
-
High 8.6
Dimension | Untrusted Search Path (CWE-426)
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions co…
-
High 7.0
Windows Setup Files Cleanup Elevation of Privilege Vulnerability
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
-
High 7.8
Servicing Stack Updates Elevation of Privilege Vulnerability
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Setup Files Cleanup Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Update Elevation of Privilege Vulnerability
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Update Elevation of Privilege Vulnerability
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Update Service Elevation of Privilege Vulnerability
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
-
High 8.8
.NET Framework Security Feature Bypass Vulnerability
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
-
Medium 5.4
Potential Privilege Escalation in InstallShield
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisite…
-
High 7.8
IBM Aspera Enterprise Webapps Untrusted Search Path
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
-
Medium 5.2
mk-oracle: Local privilege escalation via malicious Oracle Instant Client
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
-
High 7.7
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a r…
-
High 8.4
Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying …
-
High 8.8CVE-2026-59265 Public exploit
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, which …
-
High 7.0
Local Privilege Escalation in Ghostscript for Windows
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installa…
-
Medium 5.4
Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute …
-
Medium 6.7
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execu…
-
High 7.0
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a ma…
-
High 8.7
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remot…
-
Medium 5.0
n8n before 1.123.76 Sandbox Escape via Git Relative URL
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclo…
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute …
-
Medium 4.0
Acrobat Reader | Untrusted Search Path (CWE-426)
Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyond the attacker's con…
-
High 7.0
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh`…
-
High 7.5
Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverifi…
-
High 7.8
Windows Smart Card Elevation of Privilege Vulnerability
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.
-
High 7.8CVE-2026-69328 Public exploit
Windows Storage Elevation of Privilege Vulnerability
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 8.5
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perfor…
-
High 8.4
Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files
Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill executio…
-
Medium 5.5
openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the ba…
-
High 7.8
Substance3D - Painter | Untrusted Search Path (CWE-426)
Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue re…
-
High 7.8
NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or …
-
Critical 9.9
Untrusted Search Path in StackGres
privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges
-
Critical 9.4
CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/management/postgres/pool/pro…