Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
318 results · Clear filters · Feed
-
Medium 6.7
Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow …
-
Medium 6.7
Uncontrolled search path element for some Intel(R) Driver & Support Assistant Tool software before version 24.6.49.…
-
Medium 6.7
Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.1 may allow an auth…
-
Medium 6.7
Uncontrolled search path for some Clock Jitter Tool software before version 6.0.1 may allow an authenticated user to po…
-
Medium 6.7
Uncontrolled search path for the Intel(R) Trace Analyzer and Collector software all verions may allow an authenticated …
-
Medium 6.7
Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated …
-
Medium 5.4
DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load B…
-
Medium 5.9
Uncontrolled Search Path Element in Arm Development Studio before 2025
Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio.
-
Medium 6.7
A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allo…
-
Medium 5.1
Emerson ValveLink Products Uncontrolled Search Path Element
Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
-
Medium 6.5
DLL-HiJacking
Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin).
-
Medium 5.7
Arbitrary File write in OSV-SCALIBR
Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
-
Medium 6.8
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could …
-
Medium 6.7
An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to es…
-
Medium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to COM hijacking
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
-
Medium 6.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
-
Medium 6.8CVE-2024-13946 Public exploit
Binary Planting / LoadLibrary DLL's not Signed
DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
-
Medium 6.7
Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enab…
-
Medium 6.7
Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an auth…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.10…
-
Medium 6.7
Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potenti…
-
Medium 6.7
Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially en…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable esca…
-
Medium 6.7
Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escal…
-
Medium 6.7
Uncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated use…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Graphics software for Intel(R) Arc™ graphics and Intel(R) Iris(R) Xe graphic…
-
Medium 6.7
Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authen…
-
Medium 5.2
Privilege escalation in jar_signature
Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access to JAVA_HOME/bin directory to escalate privileges.
-
Medium 5.7
Microsoft Power Automate Desktop Information Disclosure Vulnerability
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory
Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended fi…
-
Medium 6.5
Sub::HandlesVia for Perl allows untrusted code to be included from the current working directory
Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended fil…
-
Medium 6.5
Mite for Perl generates code with an untrusted search path vulnerability
Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, poten…
-
Medium 5.8
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
-
Medium 6.8
Local Privilege Escalation in Rufus 4.6 and previous versions
Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been g…
-
Medium 6.7
Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows b…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an a…
-
Medium 6.7
Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authent…
-
Medium 6.7
Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) …
-
Medium 6.7
Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an auth…