CWE-427
Allowed-with-ReviewUncontrolled Search Path Element
Abstraction: Base · Status: Draft
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
1786 vulnerabilities reference this CWE, most recent first.
GHSA-4CHM-WMXX-RWF9
Vulnerability from github – Published: 2022-05-28 00:00 – Updated: 2022-06-09 00:00An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-30701"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-27T00:15:00Z",
"severity": "HIGH"
},
"details": "An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-4chm-wmxx-rwf9",
"modified": "2022-06-09T00:00:21Z",
"published": "2022-05-28T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30701"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000291008"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-797"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CR8-MRWP-P7XM
Vulnerability from github – Published: 2022-02-10 00:00 – Updated: 2022-02-10 00:00Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
{
"affected": [],
"aliases": [
"CVE-2021-44205"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-04T23:15:00Z",
"severity": "HIGH"
},
"details": "Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287",
"id": "GHSA-4cr8-mrwp-p7xm",
"modified": "2022-02-10T00:00:41Z",
"published": "2022-02-10T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44205"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-3059"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4G4P-42WC-9F3M
Vulnerability from github – Published: 2022-02-11 23:39 – Updated: 2022-04-20 16:25Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.
This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.
Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
For more information
If you have any questions or comments about this advisory:
* Start a discussion in the Git LFS discussion page.
* If you cannot open a discussion, please email the core team using their usernames at github.com.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/git-lfs/git-lfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-27955"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-21T22:10:31Z",
"nvd_published_at": "2020-11-05T15:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nOn Windows, if Git LFS operates on a malicious repository with a `git.bat` or `git.exe` file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.\n\nThis occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.\n\n### Patches\nThis version should be patched in v2.12.1, which will be released in coordination with this security advisory.\n\n### Workarounds\nOther than avoiding untrusted repositories, there is no workaround.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).\n* If you cannot open a discussion, please email the core team using their usernames at `github.com`.\n",
"id": "GHSA-4g4p-42wc-9f3m",
"modified": "2022-04-20T16:25:04Z",
"published": "2022-02-11T23:39:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/git-lfs/git-lfs/security/advisories/GHSA-4g4p-42wc-9f3m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27955"
},
{
"type": "PACKAGE",
"url": "https://github.com/git-lfs/git-lfs"
},
{
"type": "WEB",
"url": "https://github.com/git-lfs/git-lfs/releases"
},
{
"type": "WEB",
"url": "https://legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Nov/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Git LFS can execute a Git binary from the current directory"
}
GHSA-4GC8-MMM3-6XFF
Vulnerability from github – Published: 2024-11-29 03:31 – Updated: 2026-04-08 15:31Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.
{
"affected": [],
"aliases": [
"CVE-2024-8299"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-28T23:15:03Z",
"severity": "HIGH"
},
"details": "Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local authenticated attacker to execute a malicious code by storing a specially crafted DLL in a specific folder. This could lead to disclose, tamper with, destroy, or delete information in the affected products, or cause a denial of service (DoS) condition on the products.",
"id": "GHSA-4gc8-mmm3-6xff",
"modified": "2026-04-08T15:31:42Z",
"published": "2024-11-29T03:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8299"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU93891820"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-04"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-010_en.pdf"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2024-010_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4GCF-XHRJ-G4GQ
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder.
{
"affected": [],
"aliases": [
"CVE-2025-57716"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T16:15:40Z",
"severity": "MODERATE"
},
"details": "An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder.",
"id": "GHSA-4gcf-xhrj-g4gq",
"modified": "2025-10-14T18:30:28Z",
"published": "2025-10-14T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57716"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-685"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4GH6-XG2R-CF89
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.
{
"affected": [],
"aliases": [
"CVE-2020-29157"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-14T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.",
"id": "GHSA-4gh6-xg2r-cf89",
"modified": "2022-05-24T19:07:47Z",
"published": "2022-05-24T19:07:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29157"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order"
},
{
"type": "WEB",
"url": "https://gist.github.com/blackcon/ae155656d21a2228aa25fdcb79c85159"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4H23-HJ4V-F4XG
Vulnerability from github – Published: 2025-12-19 21:30 – Updated: 2025-12-19 21:30FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.
{
"affected": [],
"aliases": [
"CVE-2023-53959"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-19T21:15:53Z",
"severity": "HIGH"
},
"details": "FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.",
"id": "GHSA-4h23-hj4v-f4xg",
"modified": "2025-12-19T21:30:20Z",
"published": "2025-12-19T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53959"
},
{
"type": "WEB",
"url": "https://filezilla-project.org"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51267"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/filezilla-client-dll-hijacking-via-missing-textshapingdll"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4H59-PFRP-MWP4
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
{
"affected": [],
"aliases": [
"CVE-2020-28950"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-04T22:15:00Z",
"severity": "HIGH"
},
"details": "The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.",
"id": "GHSA-4h59-pfrp-mwp4",
"modified": "2022-05-24T17:35:25Z",
"published": "2022-05-24T17:35:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28950"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192653"
},
{
"type": "WEB",
"url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4H6J-V5PX-XWG7
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2023-11-15 21:35Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.
{
"affected": [],
"aliases": [
"CVE-2021-31847"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-347",
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-22T14:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.",
"id": "GHSA-4h6j-v5px-xwg7",
"modified": "2023-11-15T21:35:02Z",
"published": "2022-05-24T19:15:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31847"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10369"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1104"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4HFV-G3HM-82X2
Vulnerability from github – Published: 2023-03-27 21:30 – Updated: 2023-04-03 18:32Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
{
"affected": [],
"aliases": [
"CVE-2023-28596"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-27T21:15:00Z",
"severity": "HIGH"
},
"details": "Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.",
"id": "GHSA-4hfv-g3hm-82x2",
"modified": "2023-04-03T18:32:07Z",
"published": "2023-03-27T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28596"
},
{
"type": "WEB",
"url": "https://explore.zoom.us/en/trust/security/security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
Strategy: Attack Surface Reduction
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Strategy: Attack Surface Reduction
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.
CAPEC-471: Search Order Hijacking
An adversary exploits a weakness in an application's specification of external libraries to exploit the functionality of the loader where the process loading the library searches first in the same directory in which the process binary resides and then in other directories. Exploitation of this preferential search order can allow an attacker to make the loading process load the adversary's rogue library rather than the legitimate library. This attack can be leveraged with many different libraries and with many different loading processes. No forensic trails are left in the system's registry or file system that an incorrect library had been loaded.