Weaknesses of type CWE-426

322 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2018-10875HIGHA flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a mEPSS 0.6%CVE-2025-59489HIGHUnity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code fEPSS 0.6%CVE-2020-5144—SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SYSTEM through loaded EPSS 0.6%CVE-2026-63093HIGHCursor for Windows 3.2.16 RCE via Malicious git.exe in WorkspaceEPSS 0.6%CVE-2025-26155CRITICALNCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.EPSS 0.6%CVE-2023-21764HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-29790HIGHkodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.EPSS 0.6%CVE-2025-4802HIGHUntrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading ofEPSS 0.6%CVE-2025-65078CRITICALUntrusted search path vulnerability in Embedded Solutions FrameworkEPSS 0.5%CVE-2020-10733—The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in theEPSS 0.5%CVE-2024-3220LOWDefault mimetype known files writeable on WindowsEPSS 0.5%CVE-2023-4736HIGHUntrusted Search Path in vim/vimEPSS 0.5%CVE-2024-53407LOWIn Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote contEPSS 0.5%CVE-2023-26038MEDIUMZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`EPSS 0.5%CVE-2023-40590HIGHUntrusted search path on Windows systems leading to arbitrary code executionEPSS 0.5%CVE-2025-40909MEDIUMPerl threads have a working directory race condition where file operations may target unintended pathsEPSS 0.5%CVE-2026-57097MEDIUMMicrosoft XML Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-25190HIGHWindows GDI Remote Code Execution VulnerabilityEPSS 0.5%CVE-2024-43576HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2018-10874HIGHIn ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacEPSS 0.5%