CWE-426.

draw.io Desktop allows Windows executable search-path hijacking

• jgraph drawio-desktop
• CWE-426

pgAdmin 4: Utility binary path can point at a shared storage directory

• pgadmin.org pgAdmin 4
• CWE-426
• CWE-427

Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location

• asterisk
• certified-asterisk
• CWE-426

Untrusted search path in Veeam Agent for Linux

• Veeam Agent for Linux
• CWE-426

mk-oracle: Local privilege escalation via insecure Oracle Home library loading

• Checkmk
• CWE-426
• CWE-829

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.

• CWE-426

GlobalProtect App: Local Privilege Escalation Vulnerability on macOS

• Palo Alto Networks GlobalProtect App
• CWE-426

Dimension | Untrusted Search Path (CWE-426)

• Adobe Dimension
• CWE-426

Windows Setup Files Cleanup Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

Servicing Stack Updates Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

Windows Setup Files Cleanup Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Race condition
• CWE-426

Windows Update Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• CWE-426

Windows Update Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• CWE-426

Windows Update Service Elevation of Privilege Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• CWE-426

.NET Framework Security Feature Bypass Vulnerability

• Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
• Microsoft .NET Framework 3.5 AND 4.7.2
• CWE-426

Potential Privilege Escalation in InstallShield

• Flexera InstallShield
• CWE-426

IBM Aspera Enterprise Webapps Untrusted Search Path

• IBM Aspera Enterprise WebApps
• CWE-426

mk-oracle: Local privilege escalation via malicious Oracle Instant Client

• Checkmk
• CWE-426
• CWE-829

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

• CWE-426
• CWE-436

<1.15.4 · fixed in 1.15.4

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

• Mitel MiVoice Office 400
• Path traversal
• CWE-426

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

• Apache Software Foundation Apache OpenOffice
• CWE-426

Local Privilege Escalation in Ghostscript for Windows

• Artifex Software Inc. Ghostscript
• CWE-426

Untrusted Search Path (PATH Hijacking) in fuse-archive

• Google fuse-archive
• CWE-426

OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows

• OpenClaw
• CWE-426

GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

• GNU libextractor
• CWE-426

Untrusted search path in WebPros Plesk and others

• WebPros Plesk
• WebPros Plesk extension "Plesk RESTful API"
• CWE-426

n8n before 1.123.76 Sandbox Escape via Git Relative URL

• n8n
• CWE-426

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

• CWE-426

<1.16.0-beta.2 · fixed in 1.16.0-beta.2

GlobalProtect App: Local Privilege Escalation Vulnerabilities

• Palo Alto Networks GlobalProtect App
• CWE-426

Acrobat Reader | Untrusted Search Path (CWE-426)

• Adobe Acrobat
• Adobe Acrobat Reader
• CWE-426

Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

• Okta Hyperdrive Integration Plugin
• CWE-426

Windows Smart Card Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

Windows Storage Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

Untrusted search path in OpenVPN

• OpenVPN
• CWE-426

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

• CWE-426
• CWE-427

<3.10.3 · fixed in 3.10.3

Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

• kerberosmansour hulumi
• CWE-426

openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

• jahlives openssl_encrypt
• CWE-426

Substance3D - Painter | Untrusted Search Path (CWE-426)

• Adobe Substance3D - Painter
• CWE-426

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

• Code injection
• CWE-426

>=3.9.26, <4.6.58 · fixed in 4.6.58

Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426/CWE-427)

• CWE-426

<=3.10.2 · no fixed version yet

Untrusted Search Path in StackGres

• OnGres StackGres
• CWE-426

CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`

• cloudnative-pg
• CWE-426

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• CWE-426

IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

• i
• CWE-426

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

• IBM i Access Client Solutions
• CWE-426

PostgreSQL amcheck does not clear untrusted search path

• PostgreSQL
• CWE-426

GlobalProtect App: Local Privilege Escalation Vulnerabilities

• Palo Alto Networks GlobalProtect App
• CWE-426

Windows Narrator Braille Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• CWE-426

Untrusted search path in Intel(R) Performance Counter Monitor (Intel(R) PCM)

• Intel(R) Performance Counter Monitor (Intel(R) PCM)
• CWE-426

Untrusted search path in Battery Life Diagnostic Tool software

• Battery Life Diagnostic Tool software
• CWE-426

FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path

• Zucchetti S.p.a. FirmaCheck
• CWE-426

CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path

• CheckMAL AppCheck Pro
• CWE-426
• CWE-427

Bridge | Untrusted Search Path (CWE-426)

• Adobe Bridge
• CWE-426

Bridge | Untrusted Search Path (CWE-426)

• Adobe Bridge
• CWE-426

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

• CWE-426

>=3.0.0, <4.0.1 · fixed in 4.0.1

Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

• Anysphere, Inc. Cursor
• CWE-426

CAI Content Credentials | Untrusted Search Path (CWE-426)

• Adobe Content Credentials Rust SDK
• Adobe Content Credentials Command-Line Tool
• CWE-426

Illustrator | Untrusted Search Path (CWE-426)

• Adobe Illustrator Desktop 2026
• Adobe Illustrator Desktop 2025
• CWE-426

Animate | Untrusted Search Path (CWE-426)

• Adobe Animate 2023
• Adobe Animate 2024
• CWE-426

Microsoft XML Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426