cve.bz

CWE-426: Untrusted Search Path, page 2

Filter

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

What the weakness is: CWE-426 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 1
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-426, as MITRE names them. Credits.

Ask an AI about CWE-426

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-426: Untrusted Search Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/426.html and https://cve.bz/cve/cwe/426?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.5CVE-2026-41447EPSS 0.2%

    FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory p…

  2. 8.4CVE-2026-47211EPSS 0.2%

    Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands wi…

  3. 6.4CVE-2026-18605EPSS 0.2%

    A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path.…

  4. 8.6CVE-2026-48395EPSS 0.3%

    Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this iss…

  5. 8.2CVE-2026-48391EPSS 0.3%

    Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitati…

  6. 8.7CVE-2026-63093EPSS 0.8%

    Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and o…

  7. 7.4CVE-2026-48287EPSS 0.2%

    CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of th…

  8. 8.6CVE-2026-48275EPSS 0.3%

    Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious…

  9. 7.9CVE-2026-48346EPSS 0.3%

    Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious fil…

  10. 6.8CVE-2026-57097EPSS 0.5%

    Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.

  11. 8.5CVE-2025-40945EPSS 0.2%

    A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (All versions < V2512.7000), Simcenter 3D (All versions < V2512.7000), Simcenter Femap V2506 (All vers…

  12. 6.4CVE-2026-15515EPSS 0.2%

    A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. T…

  13. 7.5CVE-2026-49145EPSS 0.5%

    App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option …

  14. 8.4CVE-2026-6901EPSS 0.2%

    Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

  15. 7.8CVE-2026-57919EPSS 0.2%

    PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker c…

  16. 7.5CVE-2026-46710EPSS 0.2%

    Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an abso…

  17. 6.9CVE-2026-45792EPSS 0.1%

    rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directo…

  18. 7.2CVE-2026-53865EPSS 0.1%

    OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operat…

  19. 7.0CVE-2026-53858EPSS 0.1%

    OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime …

  20. 7.0CVE-2026-53846EPSS 0.1%

    OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace …

  21. 7.0CVE-2026-53842EPSS 0.1%

    OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository ac…

  22. 5.0CVE-2026-54055EPSS 0.07%

    Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files o…

  23. 8.7CVE-2026-53819EPSS 0.3%

    OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute…

  24. 7.8CVE-2026-48565EPSS 0.4%

    Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

  25. 7.0CVE-2026-47648EPSS 0.2%

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-24064EPSS 0.2%

    Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library in…

  27. 8.6CVE-2026-11401EPSS 0.3%

    An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, includ…

  28. 8.6CVE-2026-11400EPSS 0.5%

    An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, incl…

  29. 9.4CVE-2026-44477EPSS 0.5%

    CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local …

  30. 9.0CVE-2026-45721EPSS 0.4%

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured serve…

  31. 0.0CVE-2026-45772EPSS 0.4%

    Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14, Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn confi…

  32. 7.8CVE-2026-30906EPSS 0.1%

    Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

  33. 5.9CVE-2026-0251EPSS 0.2%

    Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrati…

  34. 6.5CVE-2026-42830EPSS 0.5%

    Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

  35. 4.3CVE-2026-7309EPSS 0.2%

    A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfig…

  36. 7.8CVE-2026-35368EPSS 0.1%

    A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based sys…

  37. 5.4CVE-2026-35603EPSS 0.1%

    Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access p…

  38. 6.4CVE-2026-6421EPSS 0.1%

    A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is…

  39. 2.9CVE-2026-40947EPSS 0.1%

    Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.

  40. 8.6CVE-2026-27290EPSS 0.2%

    Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate cr…

  41. 8.4CVE-2026-40287EPSS 0.2%

    PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (impor…

  42. 7.8CVE-2026-40156EPSS 0.2%

    PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_fr…

  43. 7.3CVE-2026-39883EPSS 0.3%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH …

  44. 9.3CVE-2025-39666EPSS 0.1%

    Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the …

  45. 7.0CVE-2022-4987EPSS 0.1%

    Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of user-configured external applications that allows a local attacker to execute arbitrary binaries. Due to insufficient …

  46. 7.8CVE-2026-3780EPSS 0.1%

    The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same…

  47. 6.4CVE-2026-4962EPSS 0.2%

    A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs…

  48. 7.3CVE-2026-4546EPSS 0.2%

    A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. T…

  49. 7.3CVE-2026-4545EPSS 0.1%

    A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation results in uncontrolled search path. The attack is only possible with local access…

  50. 7.8CVE-2026-33156EPSS 0.2%

    ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the app…