cve.bz

CWE-426: Untrusted Search Path, page 3

Filter

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

What the weakness is: CWE-426 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 1
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-426, as MITRE names them. Credits.

Ask an AI about CWE-426

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-426: Untrusted Search Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/426.html and https://cve.bz/cve/cwe/426?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-25792EPSS 0.2%

    Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path / binary hijacking vulnerability that allows a local attacker to execute arbitrary code when the affected Windows appl…

  2. 7.3CVE-2026-32032EPSS 0.1%

    OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the host environment. An attacker with local environment access can inject a …

  3. 7.3CVE-2026-32016EPSS 0.1%

    OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute unauthorized binaries by exploiting basename-only allowlist entries. At…

  4. 7.3CVE-2026-32015EPSS 0.1%

    OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling process PATH resolution. Attackers who can influence the gateway p…

  5. 7.0CVE-2026-32009EPSS 0.1%

    OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-manager paths like /opt/homebrew/bin and /usr/local/bin. An a…

  6. 8.6CVE-2026-21333EPSS 0.2%

    Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interact…

  7. 7.8CVE-2026-25190EPSS 0.6%

    Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.

  8. 6.4CVE-2026-3787EPSS 0.2%

    A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local acc…

  9. 8.8CVE-2026-29089EPSS 0.2%

    TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functio…

  10. 8.5CVE-2026-2998EPSS 0.1%

    ERP developed by eAI Technologies has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a crafted DLL file in the same directory as the program, thereby executing arbitrary code.

  11. 7.3CVE-2026-25926EPSS 0.3%

    Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a mali…

  12. 7.3CVE-2026-2542EPSS 0.2%

    A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. …

  13. 7.3CVE-2026-2538EPSS 0.2%

    A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a re…

  14. 6.4CVE-2026-2516EPSS 0.1%

    A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDER.dll. Such manipulation leads to uncontrolled search path. The attack needs to be performed locall…

  15. 7.0CVE-2026-21508EPSS 0.5%

    Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.

  16. 7.3CVE-2025-15569EPSS 0.1%

    A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This manipulation causes uncontrolled search path. The attack requires local access. T…

  17. 7.8CVE-2026-25880EPSS 0.2%

    SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This …

  18. 2.7CVE-2025-15321EPSS 0.3%

    Tanium addressed an improper input validation vulnerability in Tanium Appliance.

  19. 5.1CVE-2025-13491EPSS 0.2%

    IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker to access sensitive files or modify configurations due to an untrusted search pat…

  20. 7.8CVE-2026-0662EPSS 0.2%

    A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

  21. 9.3CVE-2025-65078EPSS 0.6%

    An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.

  22. 7.0CVE-2026-24051EPSS 0.2%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/ho…

  23. 8.8CVE-2026-24070EPSS 0.2%

    During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permission…

  24. 6.5CVE-2026-23888EPSS 0.4%

    pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vectors: (1) …

  25. 7.8CVE-2026-23512EPSS 0.2%

    SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when u…

  26. 8.6CVE-2026-21280EPSS 0.3%

    Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical…

  27. 7.0CVE-2026-20943EPSS 0.6%

    Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.

  28. 8.5CVE-2025-12793EPSS 0.1%

    An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacker-controlled location, potentially resulting in arbitrary code execution. Refer …

  29. 8.7CVE-2019-25257EPSS 0.4%

    LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying config…

  30. 5.7CVE-2025-67722EPSS 0.1%

    FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup …

  31. 7.8CVE-2025-64785EPSS 0.5%

    Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the curr…

  32. 8.1CVE-2025-12819EPSS 0.4%

    Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.

  33. 5.9CVE-2025-49642EPSS 0.1%

    Library loading on AIX Zabbix Agent builds can be hijacked by local users with write access to the /home/cecuser directory.

  34. 9.8CVE-2025-26155EPSS 0.6%

    NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.

  35. 7.3CVE-2024-21923EPSS 0.2%

    Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

  36. 7.3CVE-2024-21922EPSS 0.2%

    A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

  37. 7.3CVE-2025-13433EPSS 0.1%

    A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows…

  38. 7.8CVE-2025-60718EPSS 0.4%

    Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.

  39. 6.3CVE-2025-43079EPSS 0.2%

    The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment.…

  40. 7.3CVE-2024-14012EPSS 0.1%

    Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can re…

  41. 7.3CVE-2025-12286EPSS 0.2%

    A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack re…

  42. 6.4CVE-2025-12247EPSS 0.2%

    A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to …

  43. 7.3CVE-2025-11940EPSS 0.2%

    A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack m…

  44. 7.4CVE-2025-59489EPSS 0.6%

    Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the…

  45. 7.0CVE-2025-9267EPSS 0.3%

    In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be e…

  46. 6.4CVE-2025-9016EPSS 0.2%

    A vulnerability has been found in Mechrevo Control Center GX V2 5.56.51.48. Affected is an unknown function of the file C:\Program Files\OEM\机械革命控制中心\AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. Such m…

  47. 6.4CVE-2025-9000EPSS 0.2%

    A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. T…

  48. 8.8CVE-2025-49457EPSS 0.7%

    Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

  49. 5.1CVE-2025-49456EPSS 0.1%

    Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.

  50. 7.8CVE-2025-5039EPSS 0.2%

    A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.