Weakness (CWE)
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
How to prevent it (3 mitigations)
-
Implementation
Properly quote the full search path before executing a program on the system.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-428
64 results · Clear filters · Feed
-
Medium 6.7
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who …
-
Medium 6.7
NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerabi…
-
Medium 6.7
eMPIA Technology｜AVACAST - Unquoted Service Path
AVACAST developed by eMPIA Technology has a Unquoted Service Path vulnerability, allowing privileged local attackers to place a malicious executable file in a specific directory, resulting in arbitrary code execution with system privileges when the AVACAST se…
-
Medium 6.7
SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the …
-
Medium 5.7
OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins
OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An attacker with write a…
-
Medium 6.7
UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) …
-
Medium 6.7
An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 m…
-
Medium 6.7
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) reg…
-
Medium 6.7
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution…
-
Medium 6.2
ActFax 10.10 Unquoted Path Services Privilege Escalation Vulnerability
ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceNT service configuration. Attackers with write permissions to Program Files directories can inject a …
-
Medium 6.2
USB Flash Drives Control 4.1.0.0 Unquoted Service Path Privilege Escalation
USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\USB Flash Drives Cont…
-
Medium 6.9
AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability
AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted service path configuration to inject malicious exec…
-
Medium 6.7
Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the w…
-
Medium 6.7
FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A…
-
Medium 6.7
Unquoted search path for some PRI Driver software before version 03.03.1002 within Ring 3: User Applications may allow …
-
Medium 6.7
Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A us…
-
Medium 6.7
Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A…
-
Medium 6.7
memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service …
-
Medium 6.7
Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file pat…
-
Medium 6.7
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the …
-
Medium 6.7
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Cont…
-
Medium 6.7
RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the wr…
-
Medium 6.7
Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application
A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the instal…
-
Medium 6.7
RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted …
-
Medium 5.3
There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated …
-
Medium 6.7
Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted…
-
Medium 6.7
The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin …
-
Medium 5.2
Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5
Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
-
Medium 6.6
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cybe…
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…
-
Medium 6.7
QVR Smart Client
An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow local authenticated administrators to execute unauthorized code or commands via unspecified vectors. We have already fix…
-
Medium 6.7
An unquoted executable path exists in Hitachi Device Manager
Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before 8.8.7-00.
-
Medium 6.5
A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could b…
-
Medium 4.9
Sunshine's unquoted executable path could lead to hijacked execution flow
Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\…
-
Medium 4.4
MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability
Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code.
-
Medium 6.7CVE-2024-31804 Public exploit
An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privil…
-
Medium 6.7
Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an…
-
Medium 6.7
Unquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before v…
-
Medium 6.7
Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may al…
-
Medium 6.7
Unquoted search path or element in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authe…