Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
314 results · Clear filters · Feed
-
Medium 5.4
Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications …
-
Medium 6.3
Improper verification of downloaded upgrades
The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.
-
Medium 5.9
Venere loads replaceable unsigned components from a writable installation location
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
-
Medium 6.7
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application load…
KEV Oct 20, 2026 -
Medium 4.4
Windows Hello Security Feature Bypass Vulnerability
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
-
Medium 5.5
Microsoft Remote Help Denial of Service Vulnerability
Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.
-
Medium 5.4
Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker …
-
Medium 6.0
Prisma Access Agent: Local Privilege Escalation
A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affect…
-
Medium 5.4
Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: Use…
-
Medium 5.4
Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Rin…
-
Medium 5.4
Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escal…
-
Medium 6.7
NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerab…
-
Medium 6.7
iDTM FDI Unauthorized Debug Interface Enablement
A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices a…
-
Medium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
-
Medium 4.4
Advant Master Online Builder DLL vulnerability
Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.
-
Medium 5.3
CPython >3.11 Insecure Input Validation resulting in privilege escalation
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VP…
-
Medium 6.7
Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An at…
-
Medium 6.7
Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacke…
-
Medium 6.3
pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence t…
-
Medium 5.2
Privilege escalation via mk_mysql agent plugin on Windows
Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary reference…
-
Medium 5.4
Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications ma…
-
Medium 5.4
Uncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version 16.0.12. within Ring …
-
Medium 5.4
Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121…
-
Medium 5.0
OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variable…
-
Medium 5.7
DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijack…
-
Medium 5.5
openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview
There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock …
-
Medium 6.1
OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy
OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models to substitute CC, CXX, CARGO_BUILD_RUSTC, and CMAKE_C_COMPILER via environment overrides. At…
-
Medium 5.1
DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation
EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highes…
-
Medium 6.7
A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could all…
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image …
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image …
-
Medium 5.6
Possible to hijack modules in current working directory
pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled directory…
-
Medium 4.7
Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.33…
-
Medium 5.0
DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious co…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.7
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled sear…
-
Medium 6.7
An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to rea…
-
Medium 6.7
Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an…