Weakness (CWE)
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
How to prevent it (3 mitigations)
-
Implementation
Properly quote the full search path before executing a program on the system.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-428
359 results · Feed
-
Medium 6.7
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the …
-
High 8.5
NetBak Replicator
An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability…
-
High 7.8
Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unq…
-
Medium 6.7
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Cont…
-
Medium 6.7
RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the wr…
-
Medium 6.7
Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application
A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the instal…
-
High 7.8
A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows
A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path.
-
Medium 6.7
RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted …
-
Medium 5.3
There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated …
-
High 7.3
Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows)
An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in the SerialInterfaceService.exe utility, a local attacker with limited privileges could place a malici…
-
Medium 6.7
Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted…
-
Medium 6.7
The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin …
-
Critical 9.2
Windows service registered with an unquoted ImagePath vulnerability in the system registry
The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the ser…
-
High 7.3
Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentia…
-
High 7.3
Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially …
-
High 7.0
MTSoftware C-Lodop CLodopPrintService unquoted search path
A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on Windows. It has been rated as critical. This issue affects some unknown processing of the component CLodopPrintService. The manipulation leads to unquoted search path. The attack needs to be approache…
-
Medium 5.2
Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5
Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.
-
High 7.3
Privilege Escalation vulnerability has been discovered in OpenText™ Service Manager.
Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation. This issue affects Service Manager: 9.70, 9.71, 9.72.
-
Medium 6.6
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cybe…
-
High 7.8
Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Pat…
-
High 7.3
In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. T…
-
Medium 5.3
Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/…
-
High 7.8
Intelbras InControl incontrol-service-watchdog.exe unquoted search path
A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to …
-
High 7.3
Grafana Agent Flow on Windows Unquoted service path
Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2
-
High 7.3
Grafana Alloy on Windows Unquoted service path
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.
-
High 7.8
Windows Setup and Deployment Elevation of Privilege Vulnerability
Windows Setup and Deployment Elevation of Privilege Vulnerability
-
Medium 6.7
QVR Smart Client
An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow local authenticated administrators to execute unauthorized code or commands via unspecified vectors. We have already fix…
-
Medium 6.7
An unquoted executable path exists in Hitachi Device Manager
Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before 8.8.7-00.
-
Medium 6.5
A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could b…
-
High 7.8
Mint Workbench I Unquoted Service Path Enumeration
Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Wor…
-
High 7.8
Intelbras InControl incontrolWebcam Service unquoted search path
A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to approach this attack…
-
High 7.8
CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation…
-
Medium 4.9
Sunshine's unquoted executable path could lead to hijacked execution flow
Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\…
-
High 7.0CVE-2024-3640 Public exploit
Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables
An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threa…
-
High 7.8
Unquoted path or search item vulnerability in SugarSync
Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.
-
High 7.2
Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability
Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although auth…
-
High 8.2
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cybe…
-
Medium 4.4
MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability
Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code.
-
Medium 6.7CVE-2024-31804 Public exploit
An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privil…
-
High 7.3
HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege
A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could be exploited to gain elevated privilege on the system.