Weaknesses of type CWE-426

351 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2026-25190HIGHWindows GDI Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-95182CRITICALAn untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafEPSS 0.5%CVE-2020-10733—The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in theEPSS 0.5%CVE-2026-70142HIGHWindows Update Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-78155CRITICALUntrusted Search Path in StackGresEPSS 0.5%CVE-2024-53407LOWIn Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote contEPSS 0.5%CVE-2023-4736HIGHUntrusted Search Path in vim/vimEPSS 0.5%CVE-2023-26038MEDIUMZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`EPSS 0.5%CVE-2023-40590HIGHUntrusted search path on Windows systems leading to arbitrary code executionEPSS 0.5%CVE-2026-57097MEDIUMMicrosoft XML Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2025-40909MEDIUMPerl threads have a working directory race condition where file operations may target unintended pathsEPSS 0.5%CVE-2026-11400HIGHPrivilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQLEPSS 0.5%CVE-2025-31480CRITICALaiven-extras allows PostgreSQL Privilege Escalation through format functionEPSS 0.5%CVE-2024-43576HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-49145HIGHApp::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrcEPSS 0.5%CVE-2018-10874HIGHIn ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacEPSS 0.5%CVE-2025-64785HIGHAcrobat Reader | Untrusted Search Path (CWE-426)EPSS 0.5%CVE-2026-44477CRITICALCloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCEEPSS 0.5%CVE-2026-42830MEDIUMAzure Monitor Agent Metrics Extension Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2020-7315MEDIUMDLL Injection vulnerability in MA for WindowsEPSS 0.5%