Weaknesses of type CWE-426

322 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2026-6901HIGHUntrusted Search PathEPSS 0.2%CVE-2026-21333HIGHIllustrator | Untrusted Search Path (CWE-426)EPSS 0.2%CVE-2026-15515HIGHTencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search pathEPSS 0.2%CVE-2025-12247HIGHHasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search pathEPSS 0.2%CVE-2025-13491MEDIUMIBM App Connect Enterprise Certified Container Information DisclosureEPSS 0.2%CVE-2026-0251MEDIUMGlobalProtect App: Local Privilege Escalation VulnerabilitiesEPSS 0.2%CVE-2026-46710HIGHNotepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search PathEPSS 0.2%CVE-2024-12168HIGHDLL Hijacking in Yandex TelemostEPSS 0.2%CVE-2026-55522HIGHPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeEPSS 0.2%CVE-2026-24064HIGHLocal Privilege Escalation via Dynamic Library Injection in Waves Central for macOSEPSS 0.2%CVE-2026-6421HIGHMobatek MobaXterm Home Edition msimg32.dll uncontrolled search pathEPSS 0.1%CVE-2026-81697HIGHopenssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative ConfigurationEPSS 0.1%CVE-2025-1755HIGHMongoDB Compass may be susceptible to local privilege escalation in WindowsEPSS 0.1%CVE-2024-21922HIGHA DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary coEPSS 0.1%CVE-2024-21923HIGHIncorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary codEPSS 0.1%CVE-2024-36071MEDIUMSamsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the instaEPSS 0.1%CVE-2026-84226HIGHOpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting aEPSS 0.1%CVE-2025-13433HIGHMuse Group MuseHub Windows Service Muse.Updater.exe unquoted search pathEPSS 0.1%CVE-2026-81192HIGHOpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSEPSS 0.1%CVE-2025-24829MEDIUMLocal privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoEPSS 0.1%