CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- uvnc ultravncUltraVNC Service version.dll uncontrolled search path7.3 High
- flos freeware notepad2Flos Freeware Notepad2 TextShaping.dll uncontrolled search path7.3 High
- flos freeware notepad2Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path7.3 High
- nickemanarin screentogifDLL Sideloading in ScreenToGif7.8 High
- getgreenshot greenshotGreenshot Vulnerable to OS Command Injection via ExternalCommand Plugin6.5 Medium
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Untrusted Search Path (CWE-426)8.6 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows GDI Remote Code Execution Vulnerability7.8 High
- uvnc ultravncUltraVNC Windows Service cryptbase.dll uncontrolled search path7.3 High
- timescale timescaledbTimescaleDB uses untrusted search path during extension upgrade8.8 High
- openclawOpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation7.3 High
- openclawOpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins7.0 High
- openclawOpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable7.3 High
openclawnpmOpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode6.9 Medium- openclawOpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS7.3 High
- openclawOpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals4.4 Medium
- eai technologies erp f2eAI Technologies｜ERP - DLL Hijacking8.5 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++ has an Untrusted Search Path7.3 High
- No product listedTotal VPN win-service.exe unquoted search path7.3 High
- flos freeware notepad2Flos Freeware Notepad2 Msimg32.dll uncontrolled search path7.3 High
- unidocs ezpdf drm reader, ezpdf reader +1 moreUnidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path7.3 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Storage Elevation of Privilege Vulnerability7.0 High
- artifex mupdfArtifex MuPDF win_main.c get_system_dpi uncontrolled search path7.3 High
- sumatrapdfreader sumatrapdfUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)7.8 High
- tanium appliance, tanos +1 moreTanium addressed an improper input validation vulnerability in Tanium Appliance.2.7 Low
- ibm app connect enterprise certified containerIBM App Connect Enterprise Certified Container Information Disclosure5.1 Medium
- autodesk 3ds maxUntrusted Search Path Vulnerability when opening max Files7.8 High
- lexmark cstat, cxtat, mslbd, mxlbd, cslbl, cxlbl, cslbn, cxlbn, cstmh, cxtmh, cstpp, cxtpp, mslsg, mxlsg, mxtct, msngm, mstgm, mxngm, mxtgm, csngv, cstgv, cxtgv, msngw, mstgw, mxtgw, cstls, cxtls, mxtls, cstmm, cxtmm, cstpc, cxtpc, mxtpm, msnsn, mstsn, mxtsn, csnzj, cstzj, cxnzj, cxtzj +1 moreUntrusted search path vulnerability in Embedded Solutions Framework9.3 Critical
- open-telemetry opentelemetry-go, opentelemetry +1 moreOpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking7.0 High
- native instruments access, native-instruments native access +1 moreLocal Privilege Escalation via DYLIB Injection in Native Instruments Native Access8.8 High
- b3log siyuanSiYuan has a File Read Interface Case Bypass Vulnerability7.5 High
- pnpmpnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)6.5 Medium
- sumatrapdfreader sumatrapdfSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp8.6 High
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Untrusted Search Path (CWE-426)8.6 High
- microsoft office, office 2016, office deployment tool +4 more +6 moreMicrosoft Office Click-To-Run Remote Code Execution Vulnerability7.0 High
- asus myasus, asci +1 moreAn uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local...8.5 High
- logicaldoc srl enterpriseLogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation8.7 High
- flarum framework, sangoma freepbx +1 moreAuthenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation5.7 Medium
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreAcrobat Reader | Untrusted Search Path (CWE-426)7.8 High
- pgbouncerUntrusted search path in auth_query connection in PgBouncer7.5 High
- zabbixAgent builds for AIX vulnerable to library loading hijacking5.8 Medium
- ncp-e secure enterprise client, ncp secure entry client +1 moreNCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted...9.8 Critical
- amd storemi™Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege...7.3 High
- amd storemi™A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege...7.3 High
- muse group musehubMuse Group MuseHub Windows Service Muse.Updater.exe unquoted search path7.3 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 24h2 +1 more +3 moreWindows Administrator Protection Elevation of Privilege Vulnerability7.8 High
- qualys inc agentLocal Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents6.3 Medium
- revenera installshieldPotential Privilege Escalation in Revenera InstallShield 2023 R17.3 High
- No product listedVeePN AVService avservice.exe unquoted search path7.3 High
- hasleo backup suiteHasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search path7.3 High
- No product listedLibreWolf Installer setup.nsi uncontrolled search path7.3 High
- Show moreLoading…