CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- adobe bridgeBridge | Untrusted Search Path (CWE-426)8.2 High
- adobe bridgeBridge | Untrusted Search Path (CWE-426)8.6 High
- anysphere cursorCursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace8.7 High
- adobe c2pa, c2pa-web, c2patool +3 more +5 moreCAI Content Credentials | Untrusted Search Path (CWE-426)7.4 High
- adobe illustrator, illustrator desktop 2025, illustrator desktop 2026 +2 moreIllustrator | Untrusted Search Path (CWE-426)8.6 High
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Untrusted Search Path (CWE-426)7.9 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreMicrosoft XML Security Feature Bypass Vulnerability6.4 Medium
- siemens comos v10.4.5, comos v10.6, designcenter nx +13 more +15 moreA vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 ...8.5 High
- lenovo pc managerTencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path7.3 High
- b&r industrial automation gmbh aprolUntrusted Search Path8.4 High
- cloudnative-pgCloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`9.4 Critical
- No product listedPBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\....7.8 High
- notepad-plus-plus, notepad-plus-plus notepad\+\+ +1 moreNotepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path7.5 High
- openclawOpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH7.2 High
- openclawOpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable7.0 High
- openclawOpenClaw < 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm_execpath7.0 High
- openclawOpenClaw < 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK_PYTHON Environment Variable7.0 High
esbuildRoot,@rootio/esbuildRoot +1 moreWithdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY8.1 High- kitty project kittyKitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol5.0 Medium
- openclawOpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env Override8.7 High
- microsoft windows narrator brailleWindows Narrator Braille Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Storage Elevation of Privilege Vulnerability7.0 High
- waves audio ltd. centralLocal Privilege Escalation via Dynamic Library Injection in Waves Central for macOS7.8 High
- petdance app::ackApp::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc7.5 High
- aws advanced go wrapperPrivilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL8.6 High
- aws advanced jdbc wrapperPrivilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL8.6 High
- q00 ouroborosOuroboros: Remote Code Execution via Untrusted Project-Directory .env8.4 High
- rtk-ai rtkRTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM6.9 Medium
- xyproto algernonAlgernon: handler.lua discovery walks parent directories above the server root9.0 Critical
- @turbo codemod, vercel turborepo, @turbo workspaces +2 moreTurborepo: Unexpected local code execution during Yarn Berry detection0.0 None
- palo alto networks globalprotect app, paloaltonetworks globalprotect, palo alto networks global protect app +2 moreGlobalProtect App: Local Privilege Escalation Vulnerabilities5.9 Medium
- zoom roomsUntrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow...7.8 High
- microsoft azure monitor agent metrics extension, azure monitor agent +1 moreAzure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability6.5 Medium
- linuxfoundation cloudnativepg, cloudnative-pg, red hat openshift data foundation 4 +2 moreCloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE9.4 Critical
- redhat openshift container platform, red hat openshift container platform 4 +1 moreOpenshift-controller-manager: openshift container platform: information disclosure via environment variable injection4.3 Medium
- uutils coreutilsuutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection7.2 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows5.4 Medium
- mobatek mobaxterm home editionMobatek MobaXterm Home Edition msimg32.dll uncontrolled search path7.3 High
- yubico libfido2, python-fido2, yubikey-manager +2 moreYubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have...2.9 Low
- adobe framemakerAdobe Framemaker | Untrusted Search Path (CWE-426)8.6 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI has RCE via Automatic tools.py Import8.4 High
- mervinpraison praisonaiPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading7.8 High
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +4 more +6 moreOpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking7.3 High
- openclawOpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend8.5 High
- checkmkomd: Local privilege escalation when executing omd commands as root9.3 Critical
- belden hirschmann industrial hivisionHirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution7.0 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation7.3 High
- openclawOpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File8.5 High
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool9.3 Critical
- openclawOpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation8.4 High
- Show moreLoading…