CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
936 vulnerabilities reference this CWE, most recent first.
GHSA-75PX-Q76W-83RC
Vulnerability from github – Published: 2023-02-07 21:30 – Updated: 2023-02-16 15:30A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
{
"affected": [],
"aliases": [
"CVE-2022-4883"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-07T19:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.",
"id": "GHSA-75px-q76w-83rc",
"modified": "2023-02-16T15:30:30Z",
"published": "2023-02-07T21:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4883"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160213"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html"
},
{
"type": "WEB",
"url": "https://lists.x.org/archives/xorg-announce/2023-January/003312.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-75W4-CPFF-GXX5
Vulnerability from github – Published: 2022-05-13 01:06 – Updated: 2022-05-13 01:06** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
{
"affected": [],
"aliases": [
"CVE-2011-3640"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-10-28T02:49:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor\u0027s response was \"Strange behavior, but we\u0027re not treating this as a security bug.\"",
"id": "GHSA-75w4-cpff-gxx5",
"modified": "2022-05-13T01:06:47Z",
"published": "2022-05-13T01:06:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3640"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=641052"
},
{
"type": "WEB",
"url": "https://hermes.opensuse.org/messages/13154861"
},
{
"type": "WEB",
"url": "https://hermes.opensuse.org/messages/13155432"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414"
},
{
"type": "WEB",
"url": "http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=97426"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/8483"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-769W-XG79-C5M6
Vulnerability from github – Published: 2023-04-04 15:30 – Updated: 2023-04-11 21:31An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.
{
"affected": [],
"aliases": [
"CVE-2023-27766"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-04T15:15:00Z",
"severity": "HIGH"
},
"details": "An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.",
"id": "GHSA-769w-xg79-c5m6",
"modified": "2023-04-11T21:31:09Z",
"published": "2023-04-04T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27766"
},
{
"type": "WEB",
"url": "https://github.com/liong007/Wondershare/issues/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76WH-WG74-2W5M
Vulnerability from github – Published: 2022-05-14 04:03 – Updated: 2022-05-14 04:03A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitrary code on Windows machines.
{
"affected": [],
"aliases": [
"CVE-2017-13070"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-11T16:29:00Z",
"severity": "HIGH"
},
"details": "A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitrary code on Windows machines.",
"id": "GHSA-76wh-wg74-2w5m",
"modified": "2022-05-14T04:03:43Z",
"published": "2022-05-14T04:03:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13070"
},
{
"type": "WEB",
"url": "https://www.qnap.com/zh-tw/security-advisory/nas-201712-08"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-77FM-4W36-VPP3
Vulnerability from github – Published: 2022-05-14 02:35 – Updated: 2026-04-13 18:30Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
{
"affected": [],
"aliases": [
"CVE-2012-1854"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-07-10T21:55:00Z",
"severity": "MODERATE"
},
"details": "Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka \"Visual Basic for Applications Insecure Library Loading Vulnerability,\" as exploited in the wild in July 2012.",
"id": "GHSA-77fm-4w36-vpp3",
"modified": "2026-04-13T18:30:34Z",
"published": "2022-05-14T02:35:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1854"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046"
},
{
"type": "WEB",
"url": "https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-046"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1854"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA12-192A.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-784M-XW5J-HRMC
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2020-5674"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-24T07:15:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-784m-xw5j-hrmc",
"modified": "2022-05-24T17:34:56Z",
"published": "2022-05-24T17:34:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5674"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN26835001/index.html"
},
{
"type": "WEB",
"url": "https://www.epson.jp/support/misc_t/201119_oshirase.htm"
},
{
"type": "WEB",
"url": "https://www.epson.jp/support/pdf/fy20-001_softwareList_20201106_b.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-785F-2Q79-JJ28
Vulnerability from github – Published: 2022-05-14 03:22 – Updated: 2022-05-14 03:22Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538.
{
"affected": [],
"aliases": [
"CVE-2018-6306"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-19T13:29:00Z",
"severity": "HIGH"
},
"details": "Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538.",
"id": "GHSA-785f-2q79-jj28",
"modified": "2022-05-14T03:22:07Z",
"published": "2022-05-14T03:22:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6306"
},
{
"type": "WEB",
"url": "https://support.kaspersky.com/vulnerability.aspx?el=12430#120418"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78JC-X38P-J87V
Vulnerability from github – Published: 2022-05-17 03:21 – Updated: 2025-04-12 12:52Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.
{
"affected": [],
"aliases": [
"CVE-2015-6305"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-09-26T01:59:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.",
"id": "GHSA-78jc-x38p-j87v",
"modified": "2025-04-12T12:52:18Z",
"published": "2022-05-17T03:21:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6305"
},
{
"type": "WEB",
"url": "https://code.google.com/p/google-security-research/issues/detail?id=460"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/38289"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133876/Cisco-AnyConnect-Secure-Mobility-Client-3.1.08009-Privilege-Elevation.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Sep/80"
},
{
"type": "WEB",
"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=41136"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033643"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78XR-CMR3-FXQ9
Vulnerability from github – Published: 2025-01-17 21:31 – Updated: 2025-03-04 15:31Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2025-21399"
],
"database_specific": {
"cwe_ids": [
"CWE-273",
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-17T20:15:46Z",
"severity": "HIGH"
},
"details": "Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability",
"id": "GHSA-78xr-cmr3-fxq9",
"modified": "2025-03-04T15:31:46Z",
"published": "2025-01-17T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21399"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21399"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-detection-script"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-mitigation-script"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-794X-9RQM-24VX
Vulnerability from github – Published: 2024-09-29 09:30 – Updated: 2024-11-04 21:30A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. The vendor was informed early on 2024-08-05 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20.
{
"affected": [],
"aliases": [
"CVE-2024-9325"
],
"database_specific": {
"cwe_ids": [
"CWE-426",
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-29T08:15:02Z",
"severity": "HIGH"
},
"details": "A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\\Program Files (x86)\\Intelbras\\Incontrol Cliente\\incontrol_webcam\\incontrol-service-watchdog.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. The vendor was informed early on 2024-08-05 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20.",
"id": "GHSA-794x-9rqm-24vx",
"modified": "2024-11-04T21:30:27Z",
"published": "2024-09-29T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9325"
},
{
"type": "WEB",
"url": "https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf"
},
{
"type": "WEB",
"url": "https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.278829"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.278829"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.385397"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.