cve.bz

CWE-426: Untrusted Search Path

Filter

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

What the weakness is: CWE-426 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 1
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-426, as MITRE names them. Credits.

Ask an AI about CWE-426

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-426: Untrusted Search Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/426.html and https://cve.bz/cve/cwe/426?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-119333EPSS 0.1%

    draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a d…

  2. 7.7CVE-2026-116243EPSS 0.3%

    pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHAR…

  3. 6.9CVE-2026-57203EPSS 0.1%

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writab…

  4. 7.3CVE-2026-105477EPSS 0.1%

    A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.

  5. 5.2CVE-2026-113461EPSS 0.1%

    Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent ha…

  6. 10.0CVE-2026-95182EPSS 0.5%

    An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

  7. 5.9CVE-2026-0315EPSS 0.1%

    A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administr…

  8. 8.6CVE-2026-103847EPSS 0.2%

    Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with…

  9. 7.0CVE-2026-83509EPSS 0.4%

    Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-83506EPSS 0.4%

    Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.

  11. 7.0CVE-2026-83505EPSS 0.3%

    Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  12. 7.8CVE-2026-70142EPSS 0.5%

    Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.

  13. 7.8CVE-2026-69882EPSS 0.6%

    Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

  14. 7.8CVE-2026-69733EPSS 0.6%

    Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.

  15. 8.8CVE-2026-108398EPSS 0.8%

    Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

  16. 5.4CVE-2026-4869EPSS 0.1%

    A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.e…

  17. 7.8CVE-2026-75782EPSS 0.1%

    IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.

  18. 5.2CVE-2026-105331EPSS 0.08%

    Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

  19. 8.5CVE-2026-106505EPSS 0.3%

    Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to c…

  20. 8.4CVE-2026-104809EPSS 0.10%

    DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without a…

  21. 8.8CVE-2026-59265EPSS 0.6%

    A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in…

  22. 7.0CVE-2026-19547EPSS 0.1%

    Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default…

  23. 5.4CVE-2026-87723EPSS 0.1%

    In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the …

  24. 5.4CVE-2026-100584EPSS 0.10%

    OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execut…

  25. 7.3CVE-2026-100310EPSS 0.1%

    GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a direc…

  26. 8.7CVE-2026-68492EPSS 0.7%

    An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

  27. 5.3CVE-2026-92587EPSS 0.3%

    n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git wa…

  28. 5.9CVE-2026-0307EPSS 0.2%

    Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrat…

  29. 7.0CVE-2026-81192EPSS 0.2%

    `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detect…

  30. 4.0CVE-2026-80159EPSS 0.2%

    Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions beyon…

  31. 6.3CVE-2026-78574EPSS 0.1%

    The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resu…

  32. 7.8CVE-2026-69785EPSS 0.5%

    Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-69328EPSS 0.5%

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

  34. 8.5CVE-2026-84226EPSS 0.1%

    OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps

  35. 8.6CVE-2026-82862EPSS 0.2%

    Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during …

  36. 8.7CVE-2026-81697EPSS 0.2%

    openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned …

  37. 7.8CVE-2026-75768EPSS 0.3%

    Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitat…

  38. 8.5CVE-2026-78680EPSS 0.2%

    NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in…

  39. 9.9CVE-2026-78155EPSS 0.5%

    privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges

  40. 9.4CVE-2026-55769EPSS 0.8%

    CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning search_path in fillDefaultParameters in pkg/manageme…

  41. 7.8CVE-2026-16869EPSS 0.2%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.

  42. 9.3CVE-2026-74872EPSS 0.7%

    openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .s…

  43. 8.8CVE-2026-16674EPSS 0.7%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.

  44. 7.8CVE-2026-14875EPSS 0.2%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.

  45. 3.8CVE-2026-14673EPSS 0.3%

    Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before …

  46. 5.9CVE-2026-0299EPSS 0.2%

    Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user…

  47. 7.8CVE-2026-56174EPSS 0.5%

    Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

  48. 5.4CVE-2026-32791EPSS 0.1%

    Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user …

  49. 5.4CVE-2026-20799EPSS 0.1%

    Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a hig…

  50. 7.8CVE-2026-55522EPSS 0.2%

    PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly…