Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-427 (对搜索路径元素未加控制) — Vulnerability Class 545

545 vulnerabilities classified as CWE-427 (对搜索路径元素未加控制). AI Chinese analysis included.

CWE-427 represents a critical input validation weakness where software relies on an uncontrolled search path to locate resources, allowing unintended actors to manipulate the lookup process. This vulnerability is typically exploited by attackers who place malicious executables or libraries in a directory that precedes legitimate system paths in the search order. When the application executes, it inadvertently loads the attacker-controlled code instead of the intended resource, leading to arbitrary code execution or privilege escalation. Developers mitigate this risk by strictly defining absolute paths for all resource lookups, ensuring that the search order is deterministic and immune to directory manipulation. Additionally, implementing secure environment variable handling and validating the integrity of loaded libraries further prevents attackers from hijacking the execution flow through path traversal techniques.

MITRE CWE Description
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory. In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled: the directory from which the program has been loaded the current working directory In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used. One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled. In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directo…
Common Consequences (1)
Confidentiality, Integrity, AvailabilityExecute Unauthorized Code or Commands
Mitigations (5)
Architecture and Design, ImplementationHard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
ImplementationWhen invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code ref…
ImplementationRemove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
ImplementationCheck your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
ImplementationUse other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Examples (2)
The following code is from a web application that allows users access to an interface through which they can update their password on the system. In this environment, user passwords can be managed using the Network Information System (NIS), which is commonly used on UNIX systems. When performing NIS updates, part of the process for updating passwords is to run a make command in the /var/yp directo…
... System.Runtime.getRuntime().exec("make"); ...
Bad · Java
In versions of Go prior to v1.19, the LookPath function would follow the conventions of the runtime OS and look for a program in the directiories listed in the current path [REF-1325].
func ExecuteGitCommand(name string, arg []string) error { c := exec.Command(name, arg...) var err error c.Path, err = exec.LookPath(name) if err != nil { return err } }
Bad · Go
CVE IDTitleCVSSSeverityPublished
CVE-2023-53937 Hubstaff 1.6.14 DLL Search Order Hijacking via wow64log Library — Hubstaff 7.8 High2025-12-18
CVE-2025-53000 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows — nbconvert 8.8AIHighAI2025-12-17
CVE-2025-13670 High Level Synthesis Compiler Security Advisory — High Level Synthesis Compiler 6.7 Medium2025-12-12
CVE-2025-13669 High Level Synthesis Compiler Security Advisory — High Level Synthesis Compiler 6.7 Medium2025-12-12
CVE-2025-13665 Quartus Prime Standard Security Advisory — Quartus Prime Standard 6.7 Medium2025-12-12
CVE-2025-13668 Quartus Prime Pro Edition Advisory — Quartus Prime Pro 6.7 Medium2025-12-11
CVE-2025-13664 Quartus Prime Standard Security Advisory — Quartus Prime Standard 6.7 Medium2025-12-11
CVE-2025-64995 Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction — DEX 6.5 Medium2025-12-11
CVE-2025-64994 Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instruction — DEX 6.5 Medium2025-12-11
CVE-2025-34421 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISP.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34417 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISO.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34419 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAISM.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34416 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPO.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34422 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIPC.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34418 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIMF.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34424 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIDP.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34423 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-34420 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAM.DLL — MailEnable 6.7AIMediumAI2025-12-10
CVE-2025-13152 Lenovo One Client 安全漏洞 — One Client 7.8 High2025-12-10
CVE-2025-12046 Lenovo App Store和Lenovo Browser 安全漏洞 — App Store 7.8 High2025-12-10
CVE-2025-34396 MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAINFY.DLL — MailEnable 6.5AIMediumAI2025-12-09
CVE-2025-5469 Dylib Hijacking in Yandex Messenger — Messenger 6.8AIMediumAI2025-12-09
CVE-2025-5471 Dylib Hijacking in Yandex Telemost — Telemost 7.7AIHighAI2025-12-09
CVE-2025-5470 Dylib Hijacking in Yandex Disk — Disk 7.7AIHighAI2025-12-09
CVE-2025-33208 NVIDIA TAO 代码问题漏洞 — TAO 8.8 High2025-12-03
CVE-2025-66476 Vim for Windows Uncontrolled Search Path Element Remote Code Execution Vulnerability — vim 7.8 High2025-12-02
CVE-2025-11772 Co-Installer Privilege Escalation — Synaptics Fingerprint Driver 6.6 Medium2025-12-01
CVE-2025-64772 Sony INZONE Hub 代码问题漏洞 — INZONE Hub 7.8AIHighAI2025-12-01
CVE-2025-64695 LogStare Collector 代码问题漏洞 — Installer of LogStare Collector (for Windows) 7.8 -2025-11-21
CVE-2025-13051 Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges — ABP and AES 7.8AIHighAI2025-11-19

Vulnerabilities classified as CWE-427 (对搜索路径元素未加控制) represent 545 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.