CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
1000 vulnerabilities reference this CWE, most recent first.
GHSA-CX3W-XQMC-84G5
Vulnerability from github – Published: 2022-02-15 00:30 – Updated: 2022-04-20 16:24Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.
This is the result of an incomplete fix for CVE-2020-27955.
This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.
Patches
This version should be patched in v2.13.2, which will be released in coordination with this security advisory.
Workarounds
Other than avoiding untrusted repositories or using a different operating system, there is no workaround.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Start a discussion in the Git LFS discussion page.
- If you cannot open a discussion, please email the core team using their usernames at
github.com.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/git-lfs/git-lfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21237"
],
"database_specific": {
"cwe_ids": [
"CWE-426",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-21T17:37:52Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nOn Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.\n\nThis is the result of an incomplete fix for CVE-2020-27955.\n\nThis issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).\n\n### Patches\nThis version should be patched in v2.13.2, which will be released in coordination with this security advisory.\n\n### Workarounds\nOther than avoiding untrusted repositories or using a different operating system, there is no workaround.\n\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).\n- If you cannot open a discussion, please email the core team using their usernames at `github.com`.",
"id": "GHSA-cx3w-xqmc-84g5",
"modified": "2022-04-20T16:24:41Z",
"published": "2022-02-15T00:30:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/git-lfs/git-lfs/security/advisories/GHSA-cx3w-xqmc-84g5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21237"
},
{
"type": "WEB",
"url": "https://github.com/git-lfs/git-lfs/commit/fc664697ed2c2081ee9633010de0a7f9debea72a"
},
{
"type": "WEB",
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27955"
},
{
"type": "PACKAGE",
"url": "https://github.com/git-lfs/git-lfs"
},
{
"type": "WEB",
"url": "https://github.com/git-lfs/git-lfs/releases/tag/v2.13.2"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0098"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Git LFS can execute a Git binary from the current directory on Windows"
}
GHSA-CXJQ-FMFX-PGF3
Vulnerability from github – Published: 2024-07-31 18:32 – Updated: 2024-07-31 18:32Untrusted Search Path vulnerability in Cato Networks SDP Client on Windows allows Privilege Escalation.This issue affects SDP Client: before 5.10.34.
{
"affected": [],
"aliases": [
"CVE-2024-6975"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T17:15:11Z",
"severity": "HIGH"
},
"details": "Untrusted Search Path vulnerability in Cato Networks SDP Client on Windows allows Privilege Escalation.This issue affects SDP Client: before 5.10.34.",
"id": "GHSA-cxjq-fmfx-pgf3",
"modified": "2024-07-31T18:32:01Z",
"published": "2024-07-31T18:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6975"
},
{
"type": "WEB",
"url": "https://support.catonetworks.com/hc/en-us/articles/19758025406621-CVE-2024-6975-Windows-SDP-Client-Local-Privilege-Escalation-via-openssl-configuration-file"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CXPP-2492-JPGW
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product.
{
"affected": [],
"aliases": [
"CVE-2020-27695"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-18T19:15:00Z",
"severity": "HIGH"
},
"details": "Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product.",
"id": "GHSA-cxpp-2492-jpgw",
"modified": "2022-05-24T17:34:31Z",
"published": "2022-05-24T17:34:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27695"
},
{
"type": "WEB",
"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-10036"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F4XV-648J-G6XJ
Vulnerability from github – Published: 2026-02-05 15:31 – Updated: 2026-03-16 15:30IBM App Connect Enterprise Certified Container up to 12.19.0 (Continuous Delivery) and 12.0 LTS (Long Term Support) could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.
{
"affected": [],
"aliases": [
"CVE-2025-13491"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-05T14:16:03Z",
"severity": "MODERATE"
},
"details": "IBM App Connect Enterprise Certified Container\u00a0up to 12.19.0 (Continuous Delivery) and\u00a012.0 LTS (Long Term Support) could allow an attacker to access sensitive files or modify configurations due to an untrusted search path.",
"id": "GHSA-f4xv-648j-g6xj",
"modified": "2026-03-16T15:30:31Z",
"published": "2026-02-05T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13491"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7259746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F52F-8FFP-VG49
Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2022-05-13 01:05Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-2226"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-07T13:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Setup file of advance preparation for e-Tax software (WEB version) (1.17.1) and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-f52f-8ffp-vg49",
"modified": "2022-05-13T01:05:57Z",
"published": "2022-05-13T01:05:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2226"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN79451345/index.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F537-RHM6-GC65
Vulnerability from github – Published: 2024-06-18 00:31 – Updated: 2024-11-04 21:30A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code. The manipulation leads to unquoted search path. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-268822 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-6080"
],
"database_specific": {
"cwe_ids": [
"CWE-426",
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T23:15:51Z",
"severity": "HIGH"
},
"details": "A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code. The manipulation leads to unquoted search path. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. VDB-268822 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-f537-rhm6-gc65",
"modified": "2024-11-04T21:30:26Z",
"published": "2024-06-18T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6080"
},
{
"type": "WEB",
"url": "https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf"
},
{
"type": "WEB",
"url": "https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.268822"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.268822"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.353502"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F5W3-73H4-JPCM
Vulnerability from github – Published: 2025-02-27 18:31 – Updated: 2025-02-27 20:59mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules. This issue affects mongosh prior to 2.3.0.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mongosh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-1756"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-27T20:59:00Z",
"nvd_published_at": "2025-02-27T16:15:39Z",
"severity": "HIGH"
},
"details": "mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user\u0027s system with elevated privilege, when a crafted file is stored in C:\\node_modules\\. This issue affects mongosh prior to 2.3.0.",
"id": "GHSA-f5w3-73h4-jpcm",
"modified": "2025-02-27T20:59:00Z",
"published": "2025-02-27T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1756"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1756"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb-js/mongosh"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/MONGOSH-2028"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "mongosh vulnerable to local privilege escalation"
}
GHSA-F5XR-Q66Q-M7V8
Vulnerability from github – Published: 2022-05-14 01:02 – Updated: 2025-04-12 12:55Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2016-0016"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-01-13T05:59:00Z",
"severity": "HIGH"
},
"details": "Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka \"DLL Loading Remote Code Execution Vulnerability.\"",
"id": "GHSA-f5xr-q66q-m7v8",
"modified": "2025-04-12T12:55:46Z",
"published": "2022-05-14T01:02:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0016"
},
{
"type": "WEB",
"url": "https://code.google.com/p/google-security-research/issues/detail?id=555"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-007"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/39233"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034661"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F69P-JVR2-8J5X
Vulnerability from github – Published: 2023-05-22 15:30 – Updated: 2024-04-04 04:16kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
{
"affected": [],
"aliases": [
"CVE-2023-29790"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-12T01:15:09Z",
"severity": "HIGH"
},
"details": "kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.",
"id": "GHSA-f69p-jvr2-8j5x",
"modified": "2024-04-04T04:16:11Z",
"published": "2023-05-22T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29790"
},
{
"type": "WEB",
"url": "https://blog.mo60.cn/index.php/archives/kodbox.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F6VC-7QMX-FFW4
Vulnerability from github – Published: 2025-06-02 15:31 – Updated: 2025-12-03 21:30Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
{
"affected": [],
"aliases": [
"CVE-2024-12168"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T13:15:20Z",
"severity": "HIGH"
},
"details": "Yandex Telemost for Desktop before 2.7.0\u00a0has a DLL Hijacking Vulnerability because an untrusted search path is used.",
"id": "GHSA-f6vc-7qmx-ffw4",
"modified": "2025-12-03T21:30:58Z",
"published": "2025-06-02T15:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12168"
},
{
"type": "WEB",
"url": "https://yandex.com/bugbounty/i/hall-of-fame-products"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.