Weaknesses of type CWE-426

351 results

Caminho de busca não confiável

Ocorre quando a aplicação busca por bibliotecas, executáveis ou arquivos em diretórios cuja ordem ou conteúdo pode ser controlado por um atacante. Se um diretório não confiável vem antes de um diretório legítimo no PATH (ou em lógica de busca customizada), o atacante injeta um arquivo malicioso com o mesmo nome para ser carregado no lugar do original.

Example

Um software Windows busca 'config.dll' primeiro no diretório atual antes de procurar em System32. Um atacante coloca uma DLL maliciosa com esse nome na pasta de trabalho; quando o software executa, carrega a versão maliciosa e compromete a máquina.

How to mitigate

Especifique sempre caminhos absolutos completos ao carregar bibliotecas e executáveis, evitando buscas dinâmicas em PATH. Em Unix/Linux, remova ou coloque o diretório atual (.) ao final do PATH, nunca no início; no Windows, configure DLL search order e use mecanismos como SetDllDirectory para restringir onde as DLLs são procuradas.

CVE-2026-83505HIGHWindows Setup Files Cleanup Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-38305HIGHDell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privEPSS 0.3%CVE-2023-36540HIGHUntrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalaEPSS 0.3%CVE-2019-6173MEDIUMA DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during instEPSS 0.3%CVE-2024-22190HIGHUntrusted search path under some conditions on Windows allows arbitrary code executionEPSS 0.3%CVE-2023-41840HIGHA untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a maliciousEPSS 0.3%CVE-2025-5180HIGHWondershare Filmora Installer NFWCHK.exe uncontrolled search pathEPSS 0.3%CVE-2026-106505HIGHBackstage: Bypass of MkDocs configuration sanitizer in TechDocs backendEPSS 0.3%CVE-2026-92587MEDIUMn8n before 1.123.76 Sandbox Escape via Git Relative URLEPSS 0.3%CVE-2026-11401HIGHPrivilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQLEPSS 0.3%CVE-2024-34123HIGHAdobe Premiere Pro arbitrary DLL loading lead to remote code executionEPSS 0.3%CVE-2021-4435HIGHYarn: untrusted search pathEPSS 0.3%CVE-2026-53819HIGHOpenClaw < 2026.5.27 - Arbitrary Homebrew Executable Execution via Workspace .env OverrideEPSS 0.3%CVE-2026-75768HIGHSubstance3D - Painter | Untrusted Search Path (CWE-426)EPSS 0.3%CVE-2026-48275HIGHIllustrator | Untrusted Search Path (CWE-426)EPSS 0.3%CVE-2026-48395HIGHBridge | Untrusted Search Path (CWE-426)EPSS 0.3%CVE-2024-27303HIGHelectron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)EPSS 0.3%CVE-2024-36507MEDIUMA untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows anEPSS 0.3%CVE-2025-4455HIGHPatch My PC Home Updater System.IO uncontrolled search pathEPSS 0.3%CVE-2019-6196MEDIUMA symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged file operations during EPSS 0.3%