Weaknesses of type CWE-426

322 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2026-49145HIGHApp::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrcEPSS 0.5%CVE-2025-64785HIGHAcrobat Reader | Untrusted Search Path (CWE-426)EPSS 0.5%CVE-2026-44477CRITICALCloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCEEPSS 0.5%CVE-2025-31480CRITICALaiven-extras allows PostgreSQL Privilege Escalation through format functionEPSS 0.5%CVE-2026-42830MEDIUMAzure Monitor Agent Metrics Extension Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2023-23920MEDIUMAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search aEPSS 0.5%CVE-2020-7315MEDIUMDLL Injection vulnerability in MA for WindowsEPSS 0.5%CVE-2021-36297HIGHSupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll filEPSS 0.5%CVE-2026-74872CRITICALopenssl_encrypt before 1.4.0 Arbitrary Code Execution via WhirlpoolEPSS 0.5%CVE-2020-7490—A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prEPSS 0.5%CVE-2021-37617HIGHUntrusted Search Path in Nextcloud Desktop ClientEPSS 0.5%CVE-2026-21508HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-45721CRITICALAlgernon: handler.lua discovery walks parent directories above the server rootEPSS 0.4%CVE-2021-21237HIGHGit LFS can execute a Git binary from the current directory on WindowsEPSS 0.4%CVE-2020-8338HIGHA DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execEPSS 0.4%CVE-2023-27760HIGHAn issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setEPSS 0.4%CVE-2023-27764HIGHAn issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_seEPSS 0.4%CVE-2023-27766HIGHAn issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_EPSS 0.4%CVE-2023-27767HIGHAn issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setuEPSS 0.4%CVE-2023-27763HIGHAn issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrEPSS 0.4%