CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
936 vulnerabilities reference this CWE, most recent first.
GHSA-FQ9J-VW4W-FR6V
Vulnerability from github – Published: 2026-06-18 13:04 – Updated: 2026-06-18 13:04Summary
Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDK_PYTHON.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could run setup through an unintended local Python path. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.5.2.
Mitigations
run Gmail setup from trusted workspaces and clear workspace env overrides until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-53842"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T13:04:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nWorkspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace `.env` in a repository opened by a trusted operator could influence which Python runtime `gcloud` used through `CLOUDSDK_PYTHON`.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw\u0027s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could run setup through an unintended local Python path. Practical impact depends on the operator\u0027s configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.5.2`.\n\n### Mitigations\n\nrun Gmail setup from trusted workspaces and clear workspace env overrides until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.",
"id": "GHSA-fq9j-vw4w-fr6v",
"modified": "2026-06-18T13:04:09Z",
"published": "2026-06-18T13:04:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53842"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-arbitrary-python-runtime-execution-via-cloudsdk-python-environment-variable"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution"
}
GHSA-FR4V-RQCF-22F4
Vulnerability from github – Published: 2022-05-24 17:03 – Updated: 2022-05-24 17:03Barco ClickShare Button R9861500D01 devices before 1.9.0 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on the ClickShare Button (R9861500D01) loads a number of DLL files dynamically without verifying their integrity.
{
"affected": [],
"aliases": [
"CVE-2019-18829"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "Barco ClickShare Button R9861500D01 devices before 1.9.0 have Missing Support for Integrity Check. The Barco signed \u0027Clickshare_For_Windows.exe\u0027 binary on the ClickShare Button (R9861500D01) loads a number of DLL files dynamically without verifying their integrity.",
"id": "GHSA-fr4v-rqcf-22f4",
"modified": "2022-05-24T17:03:50Z",
"published": "2022-05-24T17:03:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18829"
},
{
"type": "WEB",
"url": "https://labs.f-secure.com/advisories/multiple-vulnerabilities-in-barco-clickshare"
},
{
"type": "WEB",
"url": "https://www.barco.com/en/clickshare/firmware-update"
},
{
"type": "WEB",
"url": "https://www.barco.com/en/clickshare/support/software/R33050069?majorVersion=01\u0026minorVersion=10\u0026patchVersion=00\u0026buildVersion=013"
},
{
"type": "WEB",
"url": "https://www.barco.com/en/clickshare/support/software/R33050070?majorVersion=01\u0026minorVersion=10\u0026patchVersion=00\u0026buildVersion=013"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FR8W-MGP5-2P5V
Vulnerability from github – Published: 2026-02-16 09:30 – Updated: 2026-02-16 09:30A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-2542"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-16T07:17:00Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\\Program Files\\Total VPN\\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fr8w-mgp5-2p5v",
"modified": "2026-02-16T09:30:30Z",
"published": "2026-02-16T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2542"
},
{
"type": "WEB",
"url": "https://github.com/Cyber-Wo0dy/report/blob/main/totalvpn/0.5.29.0/totalvpn_unquoted_service_path.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.346127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.346127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.749365"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FRHJ-2F22-M53Q
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.
{
"affected": [],
"aliases": [
"CVE-2019-6154"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-10T17:29:00Z",
"severity": "HIGH"
},
"details": "A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.",
"id": "GHSA-frhj-2f22-m53q",
"modified": "2022-05-13T01:31:13Z",
"published": "2022-05-13T01:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6154"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/solutions/LEN-25401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FRQF-G9GP-X5QM
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:56The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.
{
"affected": [],
"aliases": [
"CVE-2019-10971"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-12T16:29:00Z",
"severity": "HIGH"
},
"details": "The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application\u0027s direct control and outside the intended directories.",
"id": "GHSA-frqf-g9gp-x5qm",
"modified": "2024-04-04T00:56:39Z",
"published": "2022-05-24T16:47:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10971"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-134-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FVVM-949W-QJ4W
Vulnerability from github – Published: 2026-05-20 15:30 – Updated: 2026-07-20 21:12RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified.
This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.
Patch
Fixed in v0.32.0 (PRs #623, #625):
.rtk/filters.tomlis now blocked by default when untrusted, with a visible warning:[rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.
- New
rtk trust/rtk untrustcommands for explicit user consent. - Trust store implemented in
src/trust.rs; trust gate added insrc/toml_filter.rs.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "rtk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45792"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-20T15:30:04Z",
"nvd_published_at": "2026-06-23T20:16:47Z",
"severity": "MODERATE"
},
"details": "RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown to the LLM, without any indication that the output has been modified.\n\nThis allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.\n\n### Patch\n\nFixed in v0.32.0 (PRs #623, #625):\n\n- `.rtk/filters.toml` is now blocked by default when untrusted, with a visible warning: `[rtk] WARNING: untrusted project filters \u2014 Filters NOT applied. Run rtk trust to review and enable.`\n- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.\n- New `rtk trust` / `rtk untrust` commands for explicit user consent.\n- Trust store implemented in `src/trust.rs`; trust gate added in `src/toml_filter.rs`.",
"id": "GHSA-fvvm-949w-qj4w",
"modified": "2026-07-20T21:12:26Z",
"published": "2026-05-20T15:30:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45792"
},
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/pull/623"
},
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/pull/625"
},
{
"type": "PACKAGE",
"url": "https://github.com/rtk-ai/rtk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM"
}
GHSA-FVXP-FGWM-PPWV
Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2022-05-17 02:43Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2016-4901"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-22T16:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-fvxp-fgwm-ppwv",
"modified": "2022-05-17T02:43:12Z",
"published": "2022-05-17T02:43:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4901"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN63012325/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000207"
},
{
"type": "WEB",
"url": "http://www.e-tax.nta.go.jp/topics/topics_281014.htm"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93606"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FW2F-F4JH-88RV
Vulnerability from github – Published: 2026-08-03 18:30 – Updated: 2026-08-03 18:30A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-18605"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-03T17:16:35Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fw2f-f4jh-88rv",
"modified": "2026-08-03T18:30:47Z",
"published": "2026-08-03T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18605"
},
{
"type": "WEB",
"url": "https://opcodic.notion.site/AppCheck-Pro-Vulnerability-Analysis-Report-2f48e7fec518803e8e7fe18e71d77dac?pvs=74"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-18605"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/852044"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385528"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/385528/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWC5-XHRG-WX5F
Vulnerability from github – Published: 2025-10-27 15:30 – Updated: 2026-02-24 09:31A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-12286"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T14:15:40Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\\Program Files (x86)\\VeePN\\avservice\\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fwc5-xhrg-wx5f",
"modified": "2026-02-24T09:31:15Z",
"published": "2025-10-27T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12286"
},
{
"type": "WEB",
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/VeePn.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.329954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.329954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.672512"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.682569"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWJM-RF5J-RGRF
Vulnerability from github – Published: 2022-05-14 01:33 – Updated: 2022-05-14 01:33Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2019-5912"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-13T18:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-fwjm-rf5j-rgrf",
"modified": "2022-05-14T01:33:28Z",
"published": "2022-05-14T01:33:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5912"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN83826673/index.html"
},
{
"type": "WEB",
"url": "http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.