CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
892 vulnerabilities reference this CWE, most recent first.
GHSA-R2P6-249C-3H56
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.
{
"affected": [],
"aliases": [
"CVE-2020-10733"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-16T15:15:00Z",
"severity": "HIGH"
},
"details": "The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer\u0027s administrative rights.",
"id": "GHSA-r2p6-249c-3h56",
"modified": "2022-05-24T17:28:22Z",
"published": "2022-05-24T17:28:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10733"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20201001-0006"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/about/news/2038"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R3CP-6F7R-WGX4
Vulnerability from github – Published: 2022-05-17 02:29 – Updated: 2025-04-20 03:40Untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 (cdrw_checker_3.1.0.lzh) and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-2230"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-07T13:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 (cdrw_checker_3.1.0.lzh) and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-r3cp-6f7r-wgx4",
"modified": "2025-04-20T03:40:25Z",
"published": "2022-05-17T02:29:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2230"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN82120115/index.html"
},
{
"type": "WEB",
"url": "http://www.nilim-cdrw.jp"
},
{
"type": "WEB",
"url": "http://www.nilim-cdrw.jp/index_help.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R3MQ-X574-632M
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:44An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path.
{
"affected": [],
"aliases": [
"CVE-2019-15295"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-21T18:15:00Z",
"severity": "HIGH"
},
"details": "An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path.",
"id": "GHSA-r3mq-x574-632m",
"modified": "2024-04-04T01:44:59Z",
"published": "2022-05-24T16:54:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15295"
},
{
"type": "WEB",
"url": "https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-serviceinstance-dll-bitdefender-antivirus-free-2020"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R3PP-MXJ9-3C69
Vulnerability from github – Published: 2022-05-14 03:17 – Updated: 2022-05-14 03:17The Installer in Whale allows DLL hijacking.
{
"affected": [],
"aliases": [
"CVE-2017-15913"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-08T03:29:00Z",
"severity": "HIGH"
},
"details": "The Installer in Whale allows DLL hijacking.",
"id": "GHSA-r3pp-mxj9-3c69",
"modified": "2022-05-14T03:17:43Z",
"published": "2022-05-14T03:17:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15913"
},
{
"type": "WEB",
"url": "https://bugbounty.whale.naver.com/en/halloffame"
},
{
"type": "WEB",
"url": "https://cve.naver.com/detail/cve-2017-15913.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R4PF-3V7R-HH55
Vulnerability from github – Published: 2024-03-04 20:42 – Updated: 2024-03-06 21:36Impact
Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.
Patches
Fixed in https://github.com/electron-userland/electron-builder/pull/8059
Workarounds
None, it executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
References
https://cwe.mitre.org/data/definitions/426.html https://cwe.mitre.org/data/definitions/427
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "app-builder-lib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "24.13.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27303"
],
"database_specific": {
"cwe_ids": [
"CWE-426",
"CWE-427"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-04T20:42:45Z",
"nvd_published_at": "2024-03-06T19:15:08Z",
"severity": "HIGH"
},
"details": "### Impact\nWindows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.\n\n### Patches\nFixed in https://github.com/electron-userland/electron-builder/pull/8059\n\n### Workarounds\nNone, it executes at the installer-level before the app is present on the system, so there\u0027s no way to check if it exists in a current installer.\n\n### References\nhttps://cwe.mitre.org/data/definitions/426.html\nhttps://cwe.mitre.org/data/definitions/427",
"id": "GHSA-r4pf-3v7r-hh55",
"modified": "2024-03-06T21:36:08Z",
"published": "2024-03-04T20:42:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27303"
},
{
"type": "WEB",
"url": "https://github.com/electron-userland/electron-builder/pull/8059"
},
{
"type": "WEB",
"url": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387"
},
{
"type": "PACKAGE",
"url": "https://github.com/electron-userland/electron-builder"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "electron-builder\u0027s NSIS installer - execute arbitrary code on the target machine (Windows only)"
}
GHSA-R6QV-PQ43-H5WG
Vulnerability from github – Published: 2022-05-24 17:04 – Updated: 2022-05-24 17:04VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a Windows machine where Workstation or View Agent is installed.
{
"affected": [],
"aliases": [
"CVE-2019-5539"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-23T20:15:00Z",
"severity": "MODERATE"
},
"details": "VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a Windows machine where Workstation or View Agent is installed.",
"id": "GHSA-r6qv-pq43-h5wg",
"modified": "2022-05-24T17:04:56Z",
"published": "2022-05-24T17:04:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5539"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2019-0023.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R758-HJVG-HGJC
Vulnerability from github – Published: 2022-05-17 02:14 – Updated: 2025-04-20 03:42Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp directory.
{
"affected": [],
"aliases": [
"CVE-2017-12480"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-06T04:29:00Z",
"severity": "HIGH"
},
"details": "Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\\Local\\Temp directory.",
"id": "GHSA-r758-hjvg-hgjc",
"modified": "2025-04-20T03:42:08Z",
"published": "2022-05-17T02:14:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12480"
},
{
"type": "WEB",
"url": "https://medium.com/%40BaYinMin/cve-2017-12480-sandboxie-installer-dll-hijacking-or-unsafe-dll-loading-vulnerability-41ad0562f41"
},
{
"type": "WEB",
"url": "https://medium.com/@BaYinMin/cve-2017-12480-sandboxie-installer-dll-hijacking-or-unsafe-dll-loading-vulnerability-41ad0562f41"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R78W-FW9G-P7RW
Vulnerability from github – Published: 2022-05-17 00:51 – Updated: 2025-04-20 03:45Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-10859"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-15T17:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in \"i-filter 6.0 installer\" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-r78w-fw9g-p7rw",
"modified": "2025-04-20T03:45:22Z",
"published": "2022-05-17T00:51:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10859"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN75929834/index.html"
},
{
"type": "WEB",
"url": "http://www.daj.jp/cs/info/2017/0912"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R7R2-RWR9-C3GJ
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2024-03-21 03:34** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
{
"affected": [],
"aliases": [
"CVE-2021-28246"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-26T08:15:00Z",
"severity": "HIGH"
},
"details": "** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"id": "GHSA-r7r2-rwr9-c3gj",
"modified": "2024-03-21T03:34:04Z",
"published": "2022-05-24T17:45:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28246"
},
{
"type": "WEB",
"url": "https://n4nj0.github.io/advisories/ca-ehealth-performance-manager"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R7XP-5XHG-3G8W
Vulnerability from github – Published: 2022-05-17 00:22 – Updated: 2025-04-20 03:47Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-10825"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-02T15:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-r7xp-5xhg-3g8w",
"modified": "2025-04-20T03:47:58Z",
"published": "2022-05-17T00:22:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10825"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN97243511/278948/index.html"
},
{
"type": "WEB",
"url": "http://flets-w.com/topics/setup_tool_vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.