cve.bz

CWE-426: Untrusted Search Path, page 5

Filter

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

What the weakness is: CWE-426 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 1
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-426, as MITRE names them. Credits.

Ask an AI about CWE-426

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-426: Untrusted Search Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/426.html and https://cve.bz/cve/cwe/426?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2024-13158EPSS 3.4%

    An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  2. 4.8CVE-2025-0459EPSS 0.2%

    A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation …

  3. 5.8CVE-2024-53866EPSS 1.0%

    The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and install…

  4. 7.8CVE-2024-11454EPSS 0.2%

    A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.

  5. 7.0CVE-2024-45207EPSS 0.2%

    DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these dire…

  6. 7.8CVE-2023-1521EPSS 0.4%

    On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the…

  7. 7.3CVE-2024-50986EPSS 1.0%

    An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.

  8. 7.8CVE-2024-49515EPSS 0.2%

    Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as progr…

  9. 7.8CVE-2024-36507EPSS 0.3%

    A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering.

  10. 7.8CVE-2024-49043EPSS 0.6%

    Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability

  11. 7.8CVE-2024-47906EPSS 0.2%

    Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

  12. 7.8CVE-2024-7995EPSS 0.2%

    A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to c…

  13. 5.3CVE-2023-32266EPSS 0.2%

    Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.   This issu…

  14. 7.8CVE-2024-47422EPSS 0.4%

    Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious path into the se…

  15. 7.8CVE-2024-43616EPSS 0.8%

    Microsoft Office Remote Code Execution Vulnerability

  16. 7.8CVE-2024-43576EPSS 0.5%

    Microsoft Office Remote Code Execution Vulnerability

  17. 8.0CVE-2024-8733EPSS 0.2%

    A potential security vulnerability has been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability.

  18. 8.5CVE-2024-9325EPSS 0.3%

    A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The ma…

  19. 8.4CVE-2024-6769EPSS 1.1%

    A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to…

  20. 7.8CVE-2024-44103EPSS 0.2%

    DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.

  21. 5.8CVE-2024-45281EPSS 0.2%

    SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to …

  22. 8.4CVE-2024-6473EPSS 0.7%

    Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

  23. 5.4CVE-2024-5623EPSS 0.2%

    An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.

  24. 7.3CVE-2024-5622EPSS 0.2%

    An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

  25. 7.3CVE-2024-38305EPSS 0.3%

    Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the executio…

  26. 8.5CVE-2024-7886EPSS 0.2%

    A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled sear…

  27. 6.5CVE-2024-42439EPSS 0.2%

    Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.

  28. 7.8CVE-2024-41865EPSS 0.3%

    Dimension versions 3.4.11 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, whic…

  29. 8.8CVE-2024-6975EPSS 0.3%

    Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.

  30. 7.8CVE-2024-6974EPSS 0.2%

    Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.

  31. 7.0CVE-2024-34123EPSS 0.3%

    Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search…

  32. 9.8CVE-2024-35260EPSS 0.8%

    An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.

  33. 6.3CVE-2024-36071EPSS 0.1%

    Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.

  34. 8.5CVE-2024-6080EPSS 0.2%

    A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to …

  35. 9.8CVE-2024-38462EPSS 0.6%

    iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.

  36. 7.8CVE-2024-30100EPSS 1.2%

    Microsoft SharePoint Server Remote Code Execution Vulnerability

  37. 7.3CVE-2024-28060EPSS 0.2%

    An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.

  38. 7.8CVE-2024-28133EPSS 0.4%

    A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.

  39. 8.8CVE-2024-32019ExploitEPSS 1.2%

    Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a…

  40. 7.8CVE-2024-20693EPSS 0.8%

    Windows Kernel Elevation of Privilege Vulnerability

  41. 7.8CVE-2024-20754EPSS 0.3%

    Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical …

  42. 8.8CVE-2024-26198EPSS 6.8%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  43. 8.8CVE-2024-21435EPSS 2.0%

    Windows OLE Remote Code Execution Vulnerability

  44. 7.3CVE-2024-27303EPSS 0.3%

    electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes …

  45. 6.3CVE-2024-25103EPSS 0.2%

    This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system. Successful explo…

  46. 7.8CVE-2024-24697EPSS 0.3%

    Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.

  47. 7.8CVE-2024-24810EPSS 0.2%

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer b…

  48. 7.5CVE-2024-23304EPSS 0.8%

    Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.

  49. 7.8CVE-2021-4435EPSS 0.3%

    An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

  50. 7.8CVE-2024-22410EPSS 0.2%

    Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files dire…