Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
318 results · Clear filters · Feed
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.7
Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled sear…
-
Medium 6.7
An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to rea…
-
Medium 6.7
Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an…
-
Medium 6.7
Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolk…
-
Medium 6.7
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a …
-
Medium 4.4
Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client
Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM re…
-
Medium 6.7
NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Sta…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; …
-
Medium 6.7
Quartus Prime Pro Edition Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1.
-
Medium 6.7
Quartus Prime Pro Edition Installer Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1.
-
Medium 6.6
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to…
-
Medium 6.7
High Level Synthesis Compiler Security Advisory
The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability
-
Medium 6.7
High Level Synthesis Compiler Security Advisory
Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level Synthesis Compiler: from 19.1 through 24.3.
-
Medium 6.7
Quartus Prime Standard Security Advisory
The System Console Utility for Windows is vulnerable to a DLL planting vulnerability
-
Medium 6.7
Quartus Prime Pro Edition Advisory
A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.
-
Medium 6.7
Quartus Prime Standard Security Advisory
A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.
-
Medium 6.5
Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows a…
-
Medium 6.5
Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instruction
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PA…
-
Medium 6.6
Co-Installer Privilege Escalation
A carefully crafted DLL, copied to C:\ProgramData\Synaptics folder, allows a local user to execute arbitrary code with elevated privileges during driver installation.
-
Medium 6.7
Uncontrolled search path for the Intel MPI Library before version 2021.16 within Ring 3: User Applications may allow an…
-
Medium 6.7
Uncontrolled search path for some FPGA Support Package for the Intel oneAPI DPC++C++ Compiler software before version 2…
-
Medium 6.7
Uncontrolled search path for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Ap…
-
Medium 6.7CVE-2025-31931 Public exploit
Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 wi…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Graphics Software before version 25.22.1502.2 within Ring 3: User Applicatio…
-
Medium 6.7
Uncontrolled search path for some System Event Log Viewer Utility software for all versions within Ring 3: User Applica…
-
Medium 6.7
Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applicatio…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Distribution for Python software installers before version 2025.2.0 within R…
-
Medium 6.7
Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within …
-
Medium 6.7
Uncontrolled search path for the Intel(R) System Support Utility before version 4.1.0 within Ring 3: User Applications …
-
Medium 6.7
Uncontrolled search path for some Intel(R) Killer(TM) Performance Suite software before version killer 4.0 40.25.509.14…
-
Medium 6.7
Uncontrolled search path for some Display Virtualization for Windows OS software before version 1797 within Ring 2: Dev…
-
Medium 6.7
Uncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applicat…
-
Medium 6.0
An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7…
-
Medium 6.7
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, …
-
Medium 6.7
NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL h…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enab…
-
Medium 6.7
Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to pot…
-
Medium 6.7
Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authen…