cve.bz

CWE-427: Uncontrolled Search Path Element, page 7

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2025-9330EPSS 0.2%

    Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must fir…

  2. 7.8CVE-2025-8614EPSS 0.3%

    NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to exe…

  3. 6.4CVE-2025-9016EPSS 0.2%

    A vulnerability has been found in Mechrevo Control Center GX V2 5.56.51.48. Affected is an unknown function of the file C:\Program Files\OEM\机械革命控制中心\AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. Such m…

  4. 6.4CVE-2025-9000EPSS 0.2%

    A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. T…

  5. 7.8CVE-2025-49571EPSS 0.2%

    Substance3D - Modeler versions 1.22.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses an uncontrolled s…

  6. 5.4CVE-2025-27717EPSS 0.2%

    Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local access

  7. 5.4CVE-2025-26404EPSS 0.1%

    Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 5.4CVE-2025-24923EPSS 0.1%

    Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 5.4CVE-2025-22838EPSS 0.1%

    Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  10. 5.4CVE-2025-21093EPSS 0.1%

    Uncontrolled search path element for some Intel(R) Driver & Support Assistant Tool software before version 24.6.49.8 may allow an authenticated user to potentially enable escalation of privilege via local access.

  11. 5.4CVE-2025-20627EPSS 0.1%

    Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  12. 5.4CVE-2025-20092EPSS 0.1%

    Uncontrolled search path for some Clock Jitter Tool software before version 6.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  13. 5.4CVE-2025-20048EPSS 0.1%

    Uncontrolled search path for the Intel(R) Trace Analyzer and Collector software all verions may allow an authenticated user to potentially enable escalation of privilege via local access.

  14. 5.4CVE-2025-20017EPSS 0.1%

    Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially enable escalation of privilege via local access.

  15. 8.5CVE-2025-30033EPSS 0.2%

    The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.

  16. 7.7CVE-2025-53395EPSS 0.2%

    Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file and a malicious VSSSvr.dll located in the same directory. When a user with admini…

  17. 7.7CVE-2025-53394EPSS 0.2%

    Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with admin…

  18. 7.0CVE-2025-25011EPSS 0.2%

    An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may …

  19. 7.0CVE-2025-0712EPSS 0.2%

    An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may …

  20. 5.4CVE-2025-7676EPSS 0.2%

    DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for A…

  21. 8.5CVE-2024-13976EPSS 0.2%

    A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loadin…

  22. 5.9CVE-2025-7427EPSS 0.2%

    Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Dev…

  23. 5.4CVE-2025-1729EPSS 0.2%

    A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privileges.

  24. 7.1CVE-2025-1700EPSS 0.2%

    A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate privileges during installation of the software.

  25. 7.5CVE-2025-7472EPSS 0.1%

    A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.

  26. 8.5CVE-2025-34109ExploitEPSS 0.4%

    PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitor…

  27. 5.9CVE-2025-48496EPSS 0.2%

    Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

  28. 8.8CVE-2025-36004EPSS 0.6%

    IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege.

  29. 7.3CVE-2025-49144EPSS 0.7%

    Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insec…

  30. 9.9CVE-2025-4981EPSS 1.0%

    Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the…

  31. 7.8CVE-2024-24916EPSS 2.7%

    Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin).

  32. 5.7CVE-2025-5981EPSS 0.2%

    Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container…

  33. 6.8CVE-2025-49487EPSS 0.3%

    An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An at…

  34. 7.8CVE-2025-49158EPSS 0.2%

    An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-…

  35. 8.8CVE-2025-49155EPSS 0.9%

    An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

  36. 7.5CVE-2025-33122EPSS 0.4%

    IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege.

  37. 7.3CVE-2025-49148EPSS 0.2%

    ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its o…

  38. 7.8CVE-2025-5480EPSS 0.3%

    Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute…

  39. 7.3CVE-2025-30167EPSS 0.2%

    Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and …

  40. 9.8CVE-2024-42191EPSS 0.3%

    HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.

  41. 9.8CVE-2024-42190EPSS 0.3%

    HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.

  42. 7.3CVE-2025-5180EPSS 0.3%

    A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The mani…

  43. 7.3CVE-2025-5129EPSS 0.3%

    A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Loca…

  44. 7.1CVE-2024-13946ExploitEPSS 1.1%

    DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Serie…

  45. 7.3CVE-2025-2272EPSS 0.2%

    Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05.

  46. 8.4CVE-2025-27997EPSS 0.2%

    An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory.

  47. 7.3CVE-2025-4769EPSS 0.2%

    A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The manipulation leads to uncontrolled search path. The attack needs to be approached…

  48. 7.8CVE-2025-43553EPSS 0.2%

    Substance3D - Modeler versions 1.21.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. If the application relies on a search pat…

  49. 5.4CVE-2025-21099EPSS 0.2%

    Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access.

  50. 5.4CVE-2025-20108EPSS 0.2%

    Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authenticated user to potentially enable escalation of privilege via local access.