CWE-426

High likelihood

Untrusted Search Path

Parent: CWE-642 - External Control of Critical State Data

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

657 vulnerabilities with CWE-426
CVE-2025-24827 MEDIUM
Acronis Cyber Protect Cloud Agent <39378 - Privilege Escalation
CVSS 6.3
CVE-2025-0145 MEDIUM
Zoom Workplace Apps < - Privilege Escalation
CVSS 4.6
CVE-2025-24789 HIGH
Snowflake JDBC 3.2.3-3.21.0 - Privilege Escalation via EXTERNALBROWSER Authentication on Windows
CVSS 7.8
CVE-2025-0733 MEDIUM
Postman < 11.20 - Untrusted Search Path via profapi.dll
CVSS 4.5
CVE-2025-0732 MEDIUM
Discord < 1.0.9177 - Untrusted Search Path in profapi.dll
CVSS 4.5
CVE-2025-0707 HIGH
Rise Group Rise Mode Temp CPU <2.1 - Path Traversal
CVSS 7.8
CVE-2025-0567 MEDIUM
Epic Games Launcher <17.2.1 - Path Traversal
CVSS 4.5
CVE-2025-21399 HIGH
Microsoft Edge Update < 1.3.195.43 - Elevation of Privilege via Untrusted Search Path
CVSS 7.4
CVE-2025-21365 HIGH
Microsoft 365 Apps and Office Long Term Servicing Channel - Remote Code Execution via Untrusted Search Path
CVSS 7.8
CVE-2025-0459 MEDIUM
libretro RetroArch <1.19.1 - Path Traversal
CVSS 5.3
CVE-2024-21923 HIGH
AMD StoreMI - Privilege Escalation via Untrusted Search Path
CVSS 7.3
CVE-2024-21922 HIGH
AMD StoreMI - DLL Hijacking
CVSS 7.3
CVE-2024-14012 HIGH
Revenera InstallShield <2023 R1 - Privilege Escalation
CVE-2024-12168 HIGH
Yandex Telemost for Desktop < 2.7.0 - DLL Hijacking via Untrusted Search Path
CVSS 7.8
CVE-2024-58250 CRITICAL
ppp < 2.5.2 - Privilege Escalation via Passprompt Plugin
CVSS 9.3
CVE-2024-3220 LOW
CPython < 3.14.0 - Untrusted Search Path in mimetypes Module
CVE-2024-13524 MEDIUM
OBS Studio <30.0.2 - Untrusted Search Path
CVSS 4.5
CVE-2024-55503 LOW
termius < 9.9.0 - Untrusted Search Path via DYLD_INSERT_LIBRARIES
CVSS 3.3
CVE-2024-53407 LOW
Phiewer 4.1.0 - Untrusted Search Path Leading to Command Execution via Dylib Injection
CVSS 3.3
CVE-2024-48123 HIGH
HI-SCAN 6040i Hitrax HX-03-19-I - RCE
CVSS 8.4
CVE-2024-13158 HIGH
Ivanti Endpoint Manager < 2024 - Authenticated Remote Code Execution via Unbounded Resource Search Path
CVSS 7.2
CVE-2024-53866 CRITICAL
pnpm < 9.15.0 - Untrusted Search Path via Global Cache Override Leak
CVSS 9.8
CVE-2024-11454 HIGH
Autodesk Revit 2025-2025.4 - Untrusted Search Path DLL Loading
CVSS 7.8
CVE-2024-45207 HIGH
Veeam Agent for Windows - Code Injection
CVSS 7.0
CVE-2024-50986 HIGH
Clementine 1.3.1 - Untrusted Search Path
CVSS 7.3
Details
Vulnerabilities 657
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits