CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
895 vulnerabilities reference this CWE, most recent first.
GHSA-7RJH-2M62-75VM
Vulnerability from github – Published: 2023-04-04 15:30 – Updated: 2023-04-10 18:30An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.
{
"affected": [],
"aliases": [
"CVE-2023-27759"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-04T15:15:00Z",
"severity": "HIGH"
},
"details": "An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.",
"id": "GHSA-7rjh-2m62-75vm",
"modified": "2023-04-10T18:30:21Z",
"published": "2023-04-04T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27759"
},
{
"type": "WEB",
"url": "https://github.com/liong007/Wondershare/issues/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7VJR-WM97-R84G
Vulnerability from github – Published: 2022-05-14 03:06 – Updated: 2022-05-14 03:06Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2018-0595"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-26T14:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-7vjr-wm97-r84g",
"modified": "2022-05-14T03:06:59Z",
"published": "2022-05-14T03:06:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0595"
},
{
"type": "WEB",
"url": "https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN91151862/index.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104563"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7VP7-7F27-J6QC
Vulnerability from github – Published: 2022-05-14 01:38 – Updated: 2022-05-14 01:38Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2018-16176"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-09T23:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-7vp7-7f27-j6qc",
"modified": "2022-05-14T01:38:18Z",
"published": "2022-05-14T01:38:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16176"
},
{
"type": "WEB",
"url": "https://emdb.jaea.go.jp/emdb/en/mappingtool.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN33677949/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7VW2-84H4-6844
Vulnerability from github – Published: 2024-02-06 06:30 – Updated: 2024-02-14 00:35Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.
{
"affected": [],
"aliases": [
"CVE-2024-23304"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T05:15:10Z",
"severity": "HIGH"
},
"details": "Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.",
"id": "GHSA-7vw2-84h4-6844",
"modified": "2024-02-14T00:35:41Z",
"published": "2024-02-06T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23304"
},
{
"type": "WEB",
"url": "https://cs.cybozu.co.jp/2024/010691.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN18743512"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7WFG-2GGR-WCJC
Vulnerability from github – Published: 2022-05-02 03:14 – Updated: 2022-05-02 03:14Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
{
"affected": [],
"aliases": [
"CVE-2009-0314"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-01-28T11:30:00Z",
"severity": "MODERATE"
},
"details": "Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).",
"id": "GHSA-7wfg-2ggr-wcjc",
"modified": "2022-05-02T03:14:14Z",
"published": "2022-05-02T03:14:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0314"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481556"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48271"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01195.html"
},
{
"type": "WEB",
"url": "http://bugzilla.gnome.org/show_bug.cgi?id=569214"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33759"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33769"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34522"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200903-41.xml"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:039"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33445"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7WH2-WXC7-9PH5
Vulnerability from github – Published: 2024-02-08 18:23 – Updated: 2024-02-09 21:13Summary
.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.
Details
If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.
PoC
As a standard, non-admin user: 1. Monitor the user's TEMP folder for changes using ReadDirectoryChangesW 2. On FILE_ACTION_ADDED, check if the folder name is .be 3. Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local) 4. Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll) 5. Do hacker things when the engine escalates and the malicious DLL is loaded
Proper naming for the path can be obtained by using GetModuleHandle("comctl32.dll") and GetModuleFileName.
Impact
DLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "wix"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "wix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-24810"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-08T18:23:49Z",
"nvd_published_at": "2024-02-07T03:15:50Z",
"severity": "HIGH"
},
"details": "### Summary\n.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.\n\n### Details\nIf the bundle is not run as admin, the user\u0027s TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user\u0027s TEMP folder for changes and drop its own DLL into the **.be/\u003cbundle\u003e.Local** folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.\n\n### PoC\nAs a standard, non-admin user:\n1. Monitor the user\u0027s TEMP folder for changes using ReadDirectoryChangesW\n2. On FILE_ACTION_ADDED, check if the folder name is .be\n3. Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)\n4. Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)\n5. Do hacker things when the engine escalates and the malicious DLL is loaded\n\nProper naming for the path can be obtained by using GetModuleHandle(\"comctl32.dll\") and GetModuleFileName.\n\n### Impact\nDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.",
"id": "GHSA-7wh2-wxc7-9ph5",
"modified": "2024-02-09T21:13:40Z",
"published": "2024-02-08T18:23:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-7wh2-wxc7-9ph5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24810"
},
{
"type": "WEB",
"url": "https://github.com/wixtoolset/wix/commit/fec38b6461d0551339139a2fe52403a61942adc0"
},
{
"type": "PACKAGE",
"url": "https://github.com/wixtoolset/wix"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "WiX Toolset\u0027s .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges"
}
GHSA-7WQ4-3V4V-VPP7
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2014-0315"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-08T23:55:00Z",
"severity": "MODERATE"
},
"details": "Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka \"Windows File Handling Vulnerability.\"",
"id": "GHSA-7wq4-3v4v-vpp7",
"modified": "2022-05-13T01:25:08Z",
"published": "2022-05-13T01:25:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0315"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-019"
},
{
"type": "WEB",
"url": "http://blogs.technet.com/b/srd/archive/2014/04/08/ms14-019-fixing-a-binary-hijacking-via-cmd-or-bat-file.aspx"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jul/33"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7WR9-FCQJ-58WJ
Vulnerability from github – Published: 2025-10-27 09:30 – Updated: 2025-10-27 09:30A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.
{
"affected": [],
"aliases": [
"CVE-2025-12247"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T08:15:37Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack\u0027s complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.",
"id": "GHSA-7wr9-fcqj-58wj",
"modified": "2025-10-27T09:30:16Z",
"published": "2025-10-27T09:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12247"
},
{
"type": "WEB",
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Halseo%20Backupservice.md"
},
{
"type": "WEB",
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hasleo%20Backup%20Suite%20ImageMountService.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.329918"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.329918"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.672548"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.672549"
},
{
"type": "WEB",
"url": "https://www.easyuefi.com/backup-software/downloads/Hasleo_Backup_Suite_Free.exe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7X2P-8P7J-8RJ6
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44Untrusted search path vulnerability in the installer of Houkokusyo Sakusei Shien Tool ver3.0.2 (For the first installation) (The version which was available on the website from 2017 April 4 to 2017 May 18) and ver2.0 and later (For the first installation) (The versions which were available on the website prior to 2017 April 4) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-2209"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-09T16:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the installer of Houkokusyo Sakusei Shien Tool ver3.0.2 (For the first installation) (The version which was available on the website from 2017 April 4 to 2017 May 18) and ver2.0 and later (For the first installation) (The versions which were available on the website prior to 2017 April 4) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-7x2p-8p7j-8rj6",
"modified": "2022-05-13T01:44:43Z",
"published": "2022-05-13T01:44:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2209"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN24087303/index.html"
},
{
"type": "WEB",
"url": "http://ghg-santeikohyo.env.go.jp/files/system/report_20170526.pdf"
},
{
"type": "WEB",
"url": "http://ghg-santeikohyo.env.go.jp/files/system/report_20170529_rev.pdf"
},
{
"type": "WEB",
"url": "http://ghg-santeikohyo.env.go.jp/tool"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7X52-93M7-PR95
Vulnerability from github – Published: 2022-05-17 05:39 – Updated: 2022-05-17 05:39Untrusted search path vulnerability in gdk/win32/gdkinput-win32.c in GTK+ before 2.21.8 allows local users to gain privileges via a Trojan horse Wintab32.dll file in the current working directory.
{
"affected": [],
"aliases": [
"CVE-2010-4831"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-09-06T15:55:00Z",
"severity": "MODERATE"
},
"details": "Untrusted search path vulnerability in gdk/win32/gdkinput-win32.c in GTK+ before 2.21.8 allows local users to gain privileges via a Trojan horse Wintab32.dll file in the current working directory.",
"id": "GHSA-7x52-93m7-pr95",
"modified": "2022-05-17T05:39:24Z",
"published": "2022-05-17T05:39:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4831"
},
{
"type": "WEB",
"url": "http://ftp.gnome.org/pub/gnome/sources/gtk+/2.21/gtk+-2.21.8.changes"
},
{
"type": "WEB",
"url": "http://git.gnome.org/browse/gtk+/commit/gdk/win32/gdkinput-win32.c?h=gtk-2-24\u0026id=88f54ea47d4a55bbbf9e34a7a0502f365eb69ae5\u0026ss=1"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN58019849/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000072"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/45815"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/49449"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.