CWE-427
Allowed-with-ReviewUncontrolled Search Path Element
Abstraction: Base · Status: Draft
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
1786 vulnerabilities reference this CWE, most recent first.
GHSA-5V8V-62JQ-74CH
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system.
{
"affected": [],
"aliases": [
"CVE-2021-22665"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-18T18:15:00Z",
"severity": "HIGH"
},
"details": "Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system.",
"id": "GHSA-5v8v-62jq-74ch",
"modified": "2022-05-24T17:44:48Z",
"published": "2022-05-24T17:44:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22665"
},
{
"type": "WEB",
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129798"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-042-02"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5VVJ-G783-6XF4
Vulnerability from github – Published: 2024-03-13 21:31 – Updated: 2024-06-25 00:34A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of the user's vault or has already gained access into a user's system. This attack is limited to the system in context and cannot be propagated.
{
"affected": [],
"aliases": [
"CVE-2024-22167"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T21:15:55Z",
"severity": "HIGH"
},
"details": "A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of the user\u0027s vault or has already gained access into a user\u0027s system. This attack is limited to the system in context and cannot be propagated.\u00a0\n",
"id": "GHSA-5vvj-g783-6xf4",
"modified": "2024-06-25T00:34:45Z",
"published": "2024-03-13T21:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22167"
},
{
"type": "WEB",
"url": "https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-10"
},
{
"type": "WEB",
"url": "https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W8R-9W4R-M8W8
Vulnerability from github – Published: 2024-12-19 03:30 – Updated: 2024-12-19 03:30An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.
We have already fixed the vulnerability in the following versions: QVPN Windows 2.0.0.1316 and later QVPN Windows 2.0.0.1310 and later
{
"affected": [],
"aliases": [
"CVE-2022-27595"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-19T02:15:21Z",
"severity": "HIGH"
},
"details": "An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following versions:\nQVPN Windows 2.0.0.1316 and later\nQVPN Windows 2.0.0.1310 and later",
"id": "GHSA-5w8r-9w4r-m8w8",
"modified": "2024-12-19T03:30:41Z",
"published": "2024-12-19T03:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27595"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-23-04"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W92-73JC-M2VR
Vulnerability from github – Published: 2025-07-17 21:32 – Updated: 2025-07-17 21:32A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.
{
"affected": [],
"aliases": [
"CVE-2025-1700"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-17T20:15:28Z",
"severity": "HIGH"
},
"details": "A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.",
"id": "GHSA-5w92-73jc-m2vr",
"modified": "2025-07-17T21:32:15Z",
"published": "2025-07-17T21:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1700"
},
{
"type": "WEB",
"url": "https://en-us.support.motorola.com/app/answers/detail/a_id/186730/~/motorola-software-fix-installer-vulnerability"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-194483"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5W96-GG7W-F8MG
Vulnerability from github – Published: 2025-12-01 03:30 – Updated: 2025-12-01 03:30The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
{
"affected": [],
"aliases": [
"CVE-2025-64772"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-01T01:16:00Z",
"severity": "HIGH"
},
"details": "The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.",
"id": "GHSA-5w96-gg7w-f8mg",
"modified": "2025-12-01T03:30:26Z",
"published": "2025-12-01T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64772"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN28247549"
},
{
"type": "WEB",
"url": "https://www.sony.com/electronics/support/others-software/inzone-hub"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5XG3-J2J6-RCX4
Vulnerability from github – Published: 2021-08-25 21:01 – Updated: 2021-09-09 16:46git-delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "git-delta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-36376"
],
"database_specific": {
"cwe_ids": [
"CWE-23",
"CWE-427"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-14T19:06:14Z",
"nvd_published_at": "2021-07-13T13:15:00Z",
"severity": "HIGH"
},
"details": "git-delta before 0.8.3 on Windows resolves an executable\u0027s pathname as a relative path from the current directory.",
"id": "GHSA-5xg3-j2j6-rcx4",
"modified": "2021-09-09T16:46:42Z",
"published": "2021-08-25T21:01:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36376"
},
{
"type": "WEB",
"url": "https://github.com/dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/dandavison/delta"
},
{
"type": "WEB",
"url": "https://github.com/dandavison/delta/releases/tag/0.8.3"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0105.html"
},
{
"type": "WEB",
"url": "https://vuln.ryotak.me/advisories/54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Relative Path Traversal in git-delta"
}
GHSA-62HJ-W6RJ-XGGR
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with SYSTEM privileges.
{
"affected": [],
"aliases": [
"CVE-2019-19115"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-08T22:15:00Z",
"severity": "HIGH"
},
"details": "An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with SYSTEM privileges.",
"id": "GHSA-62hj-w6rj-xggr",
"modified": "2022-05-24T17:30:23Z",
"published": "2022-05-24T17:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19115"
},
{
"type": "WEB",
"url": "https://safebreach.com/Post/Nahimic-APO-Software-Component-Driver-Deployed-with-MSI-Computers-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-19115"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-63FV-XMH7-4XVC
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-0108"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T20:15:00Z",
"severity": "HIGH"
},
"details": "Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.",
"id": "GHSA-63fv-xmh7-4xvc",
"modified": "2022-05-24T19:04:23Z",
"published": "2022-05-24T19:04:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0108"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00506.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-63H6-PHPF-QJ3F
Vulnerability from github – Published: 2022-05-13 01:45 – Updated: 2022-05-13 01:45Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.
{
"affected": [],
"aliases": [
"CVE-2017-3092"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-20T17:29:00Z",
"severity": "CRITICAL"
},
"details": "Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.",
"id": "GHSA-63h6-phpf-qj3f",
"modified": "2022-05-13T01:45:01Z",
"published": "2022-05-13T01:45:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3092"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/Digital-Editions/apsb17-20.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99024"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038658"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-63VX-4GCW-7Q7W
Vulnerability from github – Published: 2022-06-10 00:00 – Updated: 2022-06-18 00:00A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipulation leads to privilege escalation. It is possible to launch the attack remotely.
{
"affected": [],
"aliases": [
"CVE-2017-20018"
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-09T23:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipulation leads to privilege escalation. It is possible to launch the attack remotely.",
"id": "GHSA-63vx-4gcw-7q7w",
"modified": "2022-06-18T00:00:24Z",
"published": "2022-06-10T00:00:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20018"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/142406/xampp-dllhijack.txt"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.100950"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
Strategy: Attack Surface Reduction
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Strategy: Attack Surface Reduction
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.
CAPEC-471: Search Order Hijacking
An adversary exploits a weakness in an application's specification of external libraries to exploit the functionality of the loader where the process loading the library searches first in the same directory in which the process binary resides and then in other directories. Exploitation of this preferential search order can allow an attacker to make the loading process load the adversary's rogue library rather than the legitimate library. This attack can be leveraged with many different libraries and with many different loading processes. No forensic trails are left in the system's registry or file system that an incorrect library had been loaded.