Weakness (CWE)
CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
More detail
Some of the most common variants of untrusted search path are:
- In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library. Programming languages may have their own paths for locating code, e.g. PERL5LIB in Perl.
- In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
Source: MITRE CWE-426
75 results · Clear filters · Feed
-
Medium 6.9
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory.…
-
Medium 5.2
mk-oracle: Local privilege escalation via insecure Oracle Home library loading
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' pl…
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. Th…
-
Medium 5.4
Potential Privilege Escalation in InstallShield
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisite…
-
Medium 5.2
mk-oracle: Local privilege escalation via malicious Oracle Instant Client
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
-
Medium 5.4
Untrusted Search Path (PATH Hijacking) in fuse-archive
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute …
-
Medium 6.7
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execu…
-
Medium 5.0
n8n before 1.123.76 Sandbox Escape via Git Relative URL
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclo…
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute …
-
Medium 4.0
Acrobat Reader | Untrusted Search Path (CWE-426)
Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyond the attacker's con…
-
Medium 5.5
openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the ba…
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrar…
-
Medium 5.4
Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Rin…
-
Medium 5.4
Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applicati…
-
Medium 6.4
Microsoft XML Security Feature Bypass Vulnerability
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 6.7
A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1)…
-
Medium 6.9
RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM
rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest prio…
-
Medium 5.0
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by …
-
Medium 5.9
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute a…
-
Medium 6.5
Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
-
Medium 4.3
Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection
A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. …
-
Medium 5.4CVE-2026-35603 Public exploit
Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows
Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because …
-
Medium 6.5
Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin
Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path / binary hijacking vulnerability that allows a local attacker to execute arbitrary code when the affected Windows application launches exp…
-
Medium 5.7
OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins
OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An attacker with write a…
-
Medium 6.0
OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals
OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks. Attackers can modify PATH resolution after approval to execute a different binary t…
-
Medium —
OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode
### Summary In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute. ### Impact This is an allowlist bypass i…
-
Medium 5.1
IBM App Connect Enterprise Certified Container Information Disclosure
IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.
-
Medium 6.5
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vectors: (1) Malicious ZIP entrie…
-
Medium 6.5
LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters l…
-
Medium 5.7
Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. I…
-
Medium 5.8
Agent builds for AIX vulnerable to library loading hijacking
Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.
-
Medium 6.3
Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents
The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall sc…
-
Medium 6.2
Zoom Clients for Windows- Race Condition
Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.
-
Medium 5.9
Perl threads have a working directory race condition where file operations may target unintended paths
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the n…
-
Medium 6.3
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber …
-
Medium 5.2
In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
-
Medium 6.8
Local Privilege Escalation in Rufus 4.6 and previous versions
Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been g…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…