CWE-426
Allowed-with-ReviewUntrusted Search Path
Abstraction: Base · Status: Stable
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
892 vulnerabilities reference this CWE, most recent first.
GHSA-FR8W-MGP5-2P5V
Vulnerability from github – Published: 2026-02-16 09:30 – Updated: 2026-02-16 09:30A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-2542"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-16T07:17:00Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\\Program Files\\Total VPN\\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fr8w-mgp5-2p5v",
"modified": "2026-02-16T09:30:30Z",
"published": "2026-02-16T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2542"
},
{
"type": "WEB",
"url": "https://github.com/Cyber-Wo0dy/report/blob/main/totalvpn/0.5.29.0/totalvpn_unquoted_service_path.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.346127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.346127"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.749365"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FRHJ-2F22-M53Q
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.
{
"affected": [],
"aliases": [
"CVE-2019-6154"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-10T17:29:00Z",
"severity": "HIGH"
},
"details": "A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.",
"id": "GHSA-frhj-2f22-m53q",
"modified": "2022-05-13T01:31:13Z",
"published": "2022-05-13T01:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6154"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/solutions/LEN-25401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FRQF-G9GP-X5QM
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-04-04 00:56The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.
{
"affected": [],
"aliases": [
"CVE-2019-10971"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-12T16:29:00Z",
"severity": "HIGH"
},
"details": "The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application\u0027s direct control and outside the intended directories.",
"id": "GHSA-frqf-g9gp-x5qm",
"modified": "2024-04-04T00:56:39Z",
"published": "2022-05-24T16:47:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10971"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-134-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FVVM-949W-QJ4W
Vulnerability from github – Published: 2026-05-20 15:30 – Updated: 2026-05-20 15:30RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified.
This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.
Patch
Fixed in v0.32.0 (PRs #623, #625):
.rtk/filters.tomlis now blocked by default when untrusted, with a visible warning:[rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.
- New
rtk trust/rtk untrustcommands for explicit user consent. - Trust store implemented in
src/trust.rs; trust gate added insrc/toml_filter.rs.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "rtk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45792"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-426"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-20T15:30:04Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown to the LLM, without any indication that the output has been modified.\n\nThis allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.\n\n### Patch\n\nFixed in v0.32.0 (PRs #623, #625):\n\n- `.rtk/filters.toml` is now blocked by default when untrusted, with a visible warning: `[rtk] WARNING: untrusted project filters \u2014 Filters NOT applied. Run rtk trust to review and enable.`\n- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.\n- New `rtk trust` / `rtk untrust` commands for explicit user consent.\n- Trust store implemented in `src/trust.rs`; trust gate added in `src/toml_filter.rs`.",
"id": "GHSA-fvvm-949w-qj4w",
"modified": "2026-05-20T15:30:04Z",
"published": "2026-05-20T15:30:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w"
},
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/pull/623"
},
{
"type": "WEB",
"url": "https://github.com/rtk-ai/rtk/pull/625"
},
{
"type": "PACKAGE",
"url": "https://github.com/rtk-ai/rtk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM"
}
GHSA-FVXP-FGWM-PPWV
Vulnerability from github – Published: 2022-05-17 02:43 – Updated: 2022-05-17 02:43Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2016-4901"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-22T16:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-fvxp-fgwm-ppwv",
"modified": "2022-05-17T02:43:12Z",
"published": "2022-05-17T02:43:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4901"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN63012325/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000207"
},
{
"type": "WEB",
"url": "http://www.e-tax.nta.go.jp/topics/topics_281014.htm"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93606"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FWC5-XHRG-WX5F
Vulnerability from github – Published: 2025-10-27 15:30 – Updated: 2026-02-24 09:31A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-12286"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T14:15:40Z",
"severity": "HIGH"
},
"details": "A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\\Program Files (x86)\\VeePN\\avservice\\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-fwc5-xhrg-wx5f",
"modified": "2026-02-24T09:31:15Z",
"published": "2025-10-27T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12286"
},
{
"type": "WEB",
"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/VeePn.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.329954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.329954"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.672512"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.682569"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FWJM-RF5J-RGRF
Vulnerability from github – Published: 2022-05-14 01:33 – Updated: 2022-05-14 01:33Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2019-5912"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-13T18:29:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-fwjm-rf5j-rgrf",
"modified": "2022-05-14T01:33:28Z",
"published": "2022-05-14T01:33:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5912"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN83826673/index.html"
},
{
"type": "WEB",
"url": "http://micco.mars.jp/vul/2017/mhsvi20170515_01.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FWV4-GPX5-H4FG
Vulnerability from github – Published: 2022-05-17 02:46 – Updated: 2022-05-17 02:46Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
{
"affected": [],
"aliases": [
"CVE-2017-2107"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-28T16:59:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.",
"id": "GHSA-fwv4-gpx5-h4fg",
"modified": "2022-05-17T02:46:28Z",
"published": "2022-05-17T02:46:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2107"
},
{
"type": "WEB",
"url": "http://akky.xrea.jp/security/7-zip4.txt"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN86200862/index.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96431"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G23G-WW4V-93QQ
Vulnerability from github – Published: 2022-05-17 02:53 – Updated: 2022-05-17 02:53Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in the current working directory of the Kindle Setup installer.
{
"affected": [],
"aliases": [
"CVE-2017-6189"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-15T15:59:00Z",
"severity": "HIGH"
},
"details": "Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in the current working directory of the Kindle Setup installer.",
"id": "GHSA-g23g-ww4v-93qq",
"modified": "2022-05-17T02:53:42Z",
"published": "2022-05-17T02:53:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6189"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/141366/Amazon-Kindle-DLL-Hijacking.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Feb/71"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96476"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G23W-PC29-375J
Vulnerability from github – Published: 2026-07-15 00:31 – Updated: 2026-07-15 00:31CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
{
"affected": [],
"aliases": [
"CVE-2026-48287"
],
"database_specific": {
"cwe_ids": [
"CWE-426"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T22:17:00Z",
"severity": "HIGH"
},
"details": "CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker\u0027s control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.",
"id": "GHSA-g23w-pc29-375j",
"modified": "2026-07-15T00:31:42Z",
"published": "2026-07-15T00:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48287"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
Mitigation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.