CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
894 vulnerabilities reference this CWE, most recent first.
GHSA-4H39-8WQC-H6PC
Vulnerability from github – Published: 2022-05-17 00:48 – Updated: 2025-04-20 03:45Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-10860"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-15T17:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in \"i-filter 6.0 installer\" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.",
"id": "GHSA-4h39-8wqc-h6pc",
"modified": "2025-04-20T03:45:22Z",
"published": "2022-05-17T00:48:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10860"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN75929834/index.html"
},
{
"type": "WEB",
"url": "http://www.daj.jp/cs/info/2017/0912"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100916"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4JHG-WFQ8-3VGM
Vulnerability from github – Published: 2022-05-17 05:10 – Updated: 2025-04-09 04:03Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
{
"affected": [],
"aliases": [
"CVE-2008-5983"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-01-28T02:30:00Z",
"severity": "MODERATE"
},
"details": "Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.",
"id": "GHSA-4jhg-wfq8-3vgm",
"modified": "2025-04-09T04:03:32Z",
"published": "2022-05-17T05:10:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5983"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=482814"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34522"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40194"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42888"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/50858"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51024"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51040"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51087"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200903-41.xml"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200904-06.xml"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.html"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html"
},
{
"type": "WEB",
"url": "http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/01/28/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/01/30/2"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0027.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1596-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1613-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1613-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1616-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1448"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0122"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4M93-7XP3-Q2W8
Vulnerability from github – Published: 2025-01-16 00:31 – Updated: 2025-01-18 00:30An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.
{
"affected": [],
"aliases": [
"CVE-2024-55503"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T23:15:09Z",
"severity": "LOW"
},
"details": "An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.",
"id": "GHSA-4m93-7xp3-q2w8",
"modified": "2025-01-18T00:30:47Z",
"published": "2025-01-16T00:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55503"
},
{
"type": "WEB",
"url": "https://github.com/SyFi/CVE-2024-55503"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4QG6-P4V4-GRQC
Vulnerability from github – Published: 2022-05-14 01:59 – Updated: 2022-05-14 01:59Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2018-0648"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-07T14:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-4qg6-p4v4-grqc",
"modified": "2022-05-14T01:59:42Z",
"published": "2022-05-14T01:59:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0648"
},
{
"type": "WEB",
"url": "https://go.chatwork.com/download"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN39171169/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4QGR-57JQ-93VH
Vulnerability from github – Published: 2026-06-16 21:31 – Updated: 2026-06-18 20:38Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wc84-j36w-pw4x. This link is maintained to preserve external references.
Original Description
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 2026.5.2"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T20:38:43Z",
"nvd_published_at": "2026-06-16T19:17:03Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-wc84-j36w-pw4x. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.",
"id": "GHSA-4qgr-57jq-93vh",
"modified": "2026-06-18T20:38:43Z",
"published": "2026-06-16T21:31:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-wc84-j36w-pw4x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53858"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-runtime-dependency-loading-via-state-directory-environment-variable"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",
"withdrawn": "2026-06-18T20:38:43Z"
}
GHSA-4QMW-VCGW-W2VH
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2026-05-28 21:31Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka "MFC Insecure Library Loading Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-3190"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-08-31T20:00:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio .NET 2003 SP1; Visual Studio 2005 SP1, 2008 SP1, and 2010; Visual C++ 2005 SP1, 2008 SP1, and 2010; and Exchange Server 2010 Service Pack 3, 2013, and 2013 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory during execution of an MFC application such as AtlTraceTool8.exe (aka ATL MFC Trace Tool), as demonstrated by a directory that contains a TRC, cur, rs, rct, or res file, aka \"MFC Insecure Library Loading Vulnerability.\"",
"id": "GHSA-4qmw-vcgw-w2vh",
"modified": "2026-05-28T21:31:44Z",
"published": "2022-05-13T01:13:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3190"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-025"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12457"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2010-3190"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT205221"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00003.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/41212"
},
{
"type": "WEB",
"url": "http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/42811"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4QX4-V2Q7-M2GP
Vulnerability from github – Published: 2022-03-18 00:01 – Updated: 2022-03-24 00:00Anaconda Anaconda3 through 2021.11.0.0 and Miniconda3 through 11.0.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.)
{
"affected": [],
"aliases": [
"CVE-2022-26526"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-17T16:15:00Z",
"severity": "HIGH"
},
"details": "Anaconda Anaconda3 through 2021.11.0.0 and Miniconda3 through 11.0.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.)",
"id": "GHSA-4qx4-v2q7-m2gp",
"modified": "2022-03-24T00:00:25Z",
"published": "2022-03-18T00:01:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26526"
},
{
"type": "WEB",
"url": "https://docs.conda.io/en/latest/miniconda.html"
},
{
"type": "WEB",
"url": "https://github.com/continuumio/anaconda-issues/issues"
},
{
"type": "WEB",
"url": "https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3"
},
{
"type": "WEB",
"url": "https://repo.anaconda.com/miniconda"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4RXQ-J825-6WV8
Vulnerability from github – Published: 2022-05-14 01:11 – Updated: 2022-05-14 01:11Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.
{
"affected": [],
"aliases": [
"CVE-2018-19486"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-23T08:29:00Z",
"severity": "CRITICAL"
},
"details": "Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if \u0027.\u0027 were at the end of $PATH) in certain cases involving the run_command() API and run-command.c, because there was a dangerous change from execvp to execv during 2017.",
"id": "GHSA-4rxq-j825-6wv8",
"modified": "2022-05-14T01:11:03Z",
"published": "2022-05-14T01:11:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19486"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3800"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/git/git.git/commit/?id=321fd82389742398d2924640ce3a61791fd27d60"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/git/git.git/tree/Documentation/RelNotes/2.19.2.txt"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201904-13"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3829-1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106020"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042166"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4VHV-5F35-6X4H
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.
{
"affected": [],
"aliases": [
"CVE-2021-3146"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-08T20:15:00Z",
"severity": "HIGH"
},
"details": "The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.",
"id": "GHSA-4vhv-5f35-6x4h",
"modified": "2022-05-24T17:46:55Z",
"published": "2022-05-24T17:46:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3146"
},
{
"type": "WEB",
"url": "https://professional.dolby.com/siteassets/pdfs/dolby-dax2-security-advisory-2021-04-07.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4W2G-C9V6-PGV7
Vulnerability from github – Published: 2023-07-11 18:31 – Updated: 2024-04-04 06:00Improper access control in Zoom Rooms before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2023-36538"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-11T18:15:20Z",
"severity": "HIGH"
},
"details": " Improper access control in Zoom Rooms before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.\n",
"id": "GHSA-4w2g-c9v6-pgv7",
"modified": "2024-04-04T06:00:09Z",
"published": "2023-07-11T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36538"
},
{
"type": "WEB",
"url": "https://explore.zoom.us/en/trust/security/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.