cve.bz

CWE-427: Uncontrolled Search Path Element, page 8

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2025-20079EPSS 0.2%

    Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escalation of privilege via local access.

  2. 5.4CVE-2025-20043EPSS 0.2%

    Uncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

  3. 5.4CVE-2025-20041EPSS 0.2%

    Uncontrolled search path for some Intel(R) Graphics software for Intel(R) Arc™ graphics and Intel(R) Iris(R) Xe graphics before version 32.0.101.6325/32.0.101.6252 may allow an authenticated user to potentially enable escalation of privile…

  4. 5.4CVE-2025-20015EPSS 0.2%

    Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  5. 5.4CVE-2024-47800EPSS 0.2%

    Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local access.

  6. 5.4CVE-2024-47795EPSS 0.2%

    Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  7. 5.4CVE-2024-46895EPSS 0.2%

    Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 5.4CVE-2024-39833EPSS 0.2%

    Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 5.4CVE-2024-31073EPSS 0.2%

    Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of privilege via local access.

  10. 7.8CVE-2023-31358EPSS 0.2%

    A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

  11. 5.2CVE-2025-32917EPSS 0.3%

    Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access to JAVA_HOME/bin directory to escalate privileges.

  12. 7.0CVE-2025-35471EPSS 0.2%

    conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPEN…

  13. 7.3CVE-2025-4539EPSS 0.2%

    A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the component DLL File Parser. The manipulation leads to uncontrolled search path. …

  14. 7.3CVE-2025-4532EPSS 0.2%

    A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to …

  15. 7.3CVE-2025-4525EPSS 0.4%

    A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attac…

  16. 7.3CVE-2025-4455EPSS 0.3%

    A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library advapi32.dll/BCrypt.dll/comctl32.dll/crypt32.dll/dwmapi.dll/gdi32.dll/gdiplus.dll…

  17. 7.3CVE-2025-4272EPSS 0.2%

    A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\…

  18. 7.6CVE-2025-23177EPSS 0.3%

    CWE-427: Uncontrolled Search Path Element

  19. 7.8CVE-2025-2769EPSS 0.2%

    Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the abi…

  20. 7.8CVE-2025-2768EPSS 0.2%

    Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the abi…

  21. 7.8CVE-2025-43950EPSS 0.2%

    DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLL), which is then loaded by the application instead of the legitimate DLL. This causes the malicious…

  22. 7.0CVE-2024-12530EPSS 0.2%

    Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4. End-users can potentially exploit the vulnerability to execute malicious…

  23. 7.3CVE-2025-32780EPSS 0.2%

    BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By placing a malicious DLL with the name uuid.dll in the folder C:\Users\<username…

  24. 5.7CVE-2025-29817EPSS 0.9%

    Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.

  25. 7.3CVE-2025-29803EPSS 0.8%

    Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.

  26. 7.0CVE-2025-2630EPSS 0.2%

    There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into t…

  27. 7.0CVE-2025-2629EPSS 0.2%

    There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker …

  28. 7.3CVE-2025-29802EPSS 1.0%

    Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.

  29. 7.8CVE-2025-22458EPSS 0.4%

    DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.

  30. 8.4CVE-2024-11859EPSS 2.1%

    DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.

  31. 6.5CVE-2025-3051EPSS 0.4%

    Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded inste…

  32. 6.5CVE-2025-30673EPSS 0.4%

    Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instea…

  33. 6.5CVE-2025-30672EPSS 0.4%

    Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of th…

  34. 7.3CVE-2025-26631EPSS 0.6%

    Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

  35. 7.3CVE-2025-25003EPSS 0.5%

    Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.

  36. 7.3CVE-2025-24998EPSS 0.5%

    Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.

  37. 7.8CVE-2020-23438EPSS 0.2%

    Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.

  38. 7.1CVE-2024-10930EPSS 0.4%

    An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.

  39. 7.3CVE-2025-1804EPSS 0.2%

    A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to uncontrolled search path.…

  40. 8.5CVE-2024-55898EPSS 0.4%

    IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrato…

  41. 7.8CVE-2022-28339EPSS 0.3%

    Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated pri…

  42. 5.9CVE-2025-1223EPSS 0.2%

    An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac

  43. 6.8CVE-2025-26624EPSS 0.2%

    Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the e…

  44. 7.3CVE-2024-57964EPSS 0.2%

    Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects HVAC Ener…

  45. 7.3CVE-2024-57963EPSS 0.2%

    Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects USB-CONVER…

  46. 5.4CVE-2024-47006EPSS 0.2%

    Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

  47. 5.4CVE-2024-42492EPSS 0.2%

    Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.0002 may allow a privileged user to potentially enable escalation of privilege via local access.

  48. 5.4CVE-2024-42405EPSS 0.2%

    Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable escalation of privilege via local access.

  49. 5.4CVE-2024-39813EPSS 0.2%

    Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  50. 5.4CVE-2024-39372EPSS 0.2%

    Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated user to potentially enable escalation of privilege via local access.