Weaknesses of type CWE-426

323 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2019-6826—A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code executEPSS 1.2%CVE-2022-0074HIGHPrivilege Escalation in OpenLiteSpeed Web ServerEPSS 1.2%CVE-2022-4883HIGHA flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress EPSS 1.2%CVE-2024-30100HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 1.2%CVE-2024-21325HIGHMicrosoft Printer Metadata Troubleshooter Tool Remote Code Execution VulnerabilityEPSS 1.2%CVE-2024-32019HIGHndsudo: local privilege escalation via untrusted search pathEPSS 1.2%CVE-2021-21078MEDIUMAdobe Creative Cloud Unquoted Service Path in CCXProcessEPSS 1.1%CVE-2024-6769HIGHMedium to High Integrity Privilege Escalation in Microsoft WindowsEPSS 1.1%CVE-2025-30399HIGH.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 1.1%CVE-2019-10971—The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that EPSS 1.1%CVE-2020-9673HIGHAdobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vuEPSS 1.0%CVE-2020-9672HIGHAdobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vuEPSS 1.0%CVE-2023-36393HIGHWindows User Interface Application Core Remote Code Execution VulnerabilityEPSS 1.0%CVE-2023-43586HIGHPath traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user toEPSS 1.0%CVE-2024-50986HIGHAn issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.EPSS 1.0%CVE-2024-53866MEDIUMpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionEPSS 1.0%CVE-2025-21365HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.9%CVE-2018-12449—The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.EPSS 0.9%CVE-2023-26036HIGHZoneMinder contains Local File Inclusion vulnerabilityEPSS 0.9%CVE-2025-27743HIGHMicrosoft System Center Elevation of Privilege VulnerabilityEPSS 0.9%