CWE-426.

Untrusted search path in Siemens COMOS V10.4.5 and others

• Siemens COMOS V10.4.5
• Siemens COMOS V10.6
• CWE-426

Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path

• Tencent PC Manager
• CWE-426
• CWE-427

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc

• PETDANCE App::Ack
• Path traversal
• CWE-426

Untrusted Search Path

• B&R Industrial Automation GmbH APROL
• CWE-426

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

• CWE-426

<2026.5.27 · fixed in 2026.5.27

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated…

• Broken access control
• CWE-426

Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path

• notepad-plus-plus
• CWE-426

OpenClaw: Workspace-derived service PATH could influence trash command selection

• CWE-426

<2026.5.2 · fixed in 2026.5.2

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

• CWE-426

<2026.5.2 · fixed in 2026.5.2

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

• CWE-426

<2026.4.29 · fixed in 2026.4.29

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

• CWE-426

<2026.5.2 · fixed in 2026.5.2

Duplicate Advisory: Workspace-derived service PATH could influence trash command selection

• CWE-426

* · no fixed version yet

Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

• CWE-426

* · no fixed version yet

Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install

• CWE-426

* · no fixed version yet

Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

• CWE-426

* · no fixed version yet

Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

• CWE-426
• CWE-494

>=0.17.0, <0.28.1 · fixed in 0.28.1

Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

• kovidgoyal kitty
• Path traversal
• Race condition

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

• CWE-426

<1.1.1 · fixed in 1.1.1

Windows Narrator Braille Elevation of Privilege Vulnerability

• Microsoft Windows Narrator Braille
• CWE-426

Windows Storage Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS

• Waves Audio Ltd. Waves Central
• CWE-426

ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env

• CWE-426

<0.39.0 · fixed in 0.39.0

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

• CWE-345
• CWE-426

<0.32.0 · fixed in 0.32.0

Turbo: Unexpected local code execution during Yarn Berry detection

• CWE-426

>=1.1.0, <2.9.14 · fixed in 2.9.14

Algernon: handler.lua discovery walks parent directories above the server root

• Information disclosure
• CWE-20

<1.17.7 · fixed in 1.17.7

GlobalProtect App: Local Privilege Escalation Vulnerabilities

• Palo Alto Networks GlobalProtect App
• Palo Alto Networks Global Protect App
• CWE-426

Untrusted search path in Zoom Communications Zoom Rooms

• Zoom Communications Zoom Rooms
• CWE-426

Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

• Microsoft Azure Monitor Agent Metrics Extension
• CWE-426

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

• Privilege escalation
• CWE-271

<1.28.3 || >=1.29.0, <1.29.1 · fixed in 1.28.3, 1.29.1

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

• Red Hat OpenShift Container Platform 4
• CWE-426

uutils coreutils has an Untrusted Search Path

• CWE-426

<=0.8.0 · no fixed version yet

Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

• CWE-426

<2.1.75 · fixed in 2.1.75

Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

• Mobatek MobaXterm Home Edition
• CWE-426
• CWE-427

Untrusted search path in Yubico libfido2 and others

• Yubico libfido2
• Yubico python-fido2
• CWE-426

Adobe Framemaker | Untrusted Search Path (CWE-426)

• Adobe Framemaker
• CWE-426

PraisonAI Vulnerable to RCE via Automatic tools.py Import

• Code injection
• CWE-426

<4.5.139 · fixed in 4.5.139

PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading

• Code injection
• CWE-426

<4.5.128 · fixed in 4.5.128

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

• CWE-426

>=1.15.0, <1.43.0 · fixed in 1.43.0

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

• CWE-15
• CWE-426

<2026.3.24 · fixed in 2026.3.24

omd: Local privilege escalation when executing omd commands as root

• Checkmk
• CWE-426
• CWE-829

Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution

• Belden Hirschmann Industrial HiVision
• CWE-426

Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation

• Foxit Software Inc. Foxit PDF Reader
• Foxit Software Inc. Foxit PDF Editor
• CWE-426

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

• CWE-15
• CWE-426

<2026.3.28 · fixed in 2026.3.28

openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

• CWE-426
• CWE-427

<1.4.0 · fixed in 1.4.0

OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

• CWE-349
• CWE-426

<2026.3.24 · fixed in 2026.3.24

UltraVNC Service version.dll uncontrolled search path

• UltraVNC
• CWE-426
• CWE-427

Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

• Flos Freeware Notepad2
• CWE-426
• CWE-427

Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path

• Flos Freeware Notepad2
• CWE-426
• CWE-427

DLL Sideloading in ScreenToGif

• NickeManarin ScreenToGif
• CWE-426
• CWE-427

Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin

• greenshot
• CWE-426

Illustrator | Untrusted Search Path (CWE-426)

• Adobe Illustrator Desktop 2026
• Adobe Illustrator Desktop 2025
• CWE-426

Windows GDI Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-426

UltraVNC Windows Service cryptbase.dll uncontrolled search path

• UltraVNC
• CWE-426
• CWE-427

TimescaleDB uses untrusted search path during extension upgrade

• timescaledb
• CWE-426

OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks

• Broken access control
• CWE-426

>=2026.1.21, <2026.2.19 · fixed in 2026.2.19

OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

• CWE-426
• CWE-428

<2026.2.24 · fixed in 2026.2.24

OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

• Command injection
• CWE-426

<2026.2.22 · fixed in 2026.2.22

OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

• CWE-426

<2026.2.22 · fixed in 2026.2.22

OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

• Broken access control
• CWE-426

<2026.2.22 · fixed in 2026.2.22

OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

• Race condition
• CWE-426

<2026.3.1 · fixed in 2026.3.1