CWE-428
AllowedUnquoted Search Path or Element
Abstraction: Base · Status: Draft
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
772 vulnerabilities reference this CWE, most recent first.
GHSA-6FGV-P835-W43W
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-22 00:00In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
{
"affected": [],
"aliases": [
"CVE-2022-35292"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-13T16:15:00Z",
"severity": "HIGH"
},
"details": "In SAP Business One application when a service is created, the executable path contains spaces and isn\u2019t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.",
"id": "GHSA-6fgv-p835-w43w",
"modified": "2022-09-22T00:00:24Z",
"published": "2022-09-14T00:00:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-jjjv-grgr-v8h3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35292"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3223392"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6FWV-WGRV-C6GJ
Vulnerability from github – Published: 2022-05-17 01:07 – Updated: 2022-05-17 01:07An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.
{
"affected": [],
"aliases": [
"CVE-2017-3757"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-29T01:35:00Z",
"severity": "HIGH"
},
"details": "An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.",
"id": "GHSA-6fwv-wgrv-c6gj",
"modified": "2022-05-17T01:07:50Z",
"published": "2022-05-17T01:07:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3757"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-14390"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H24-XX5G-P323
Vulnerability from github – Published: 2022-05-17 00:26 – Updated: 2022-05-17 00:26Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero directory.
{
"affected": [],
"aliases": [
"CVE-2017-15383"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-16T17:29:00Z",
"severity": "HIGH"
},
"details": "Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, exploitable via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\\Nero directory.",
"id": "GHSA-6h24-xx5g-p323",
"modified": "2022-05-17T00:26:05Z",
"published": "2022-05-17T00:26:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15383"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2016110092"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/139658/Nero-7.10.1.0-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H85-5GXW-42H9
Vulnerability from github – Published: 2024-04-23 15:30 – Updated: 2024-07-03 18:36An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component.
{
"affected": [],
"aliases": [
"CVE-2024-31804"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T15:15:49Z",
"severity": "LOW"
},
"details": "An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component.",
"id": "GHSA-6h85-5gxw-42h9",
"modified": "2024-07-03T18:36:39Z",
"published": "2024-04-23T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31804"
},
{
"type": "WEB",
"url": "https://medium.com/%40kobbycyber/terratec-dmx-6fire-usb-unquoted-service-path-cve-2024-31804-70cced459202"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51977"
},
{
"type": "WEB",
"url": "https://www.ired.team/offensive-security/privilege-escalation/unquoted-service-paths"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6HQW-7984-94R6
Vulnerability from github – Published: 2022-07-22 00:00 – Updated: 2022-07-29 00:00There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.
{
"affected": [],
"aliases": [
"CVE-2022-35899"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-21T17:15:00Z",
"severity": "HIGH"
},
"details": "There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\\ASUS\\GameSDK.exe file.",
"id": "GHSA-6hqw-7984-94r6",
"modified": "2022-07-29T00:00:27Z",
"published": "2022-07-22T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35899"
},
{
"type": "WEB",
"url": "https://ASUSTeK.com"
},
{
"type": "WEB",
"url": "https://github.com/AngeloPioAmirante/CVE-2022-35899"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.html"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50985"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HRV-VGX8-Q9XM
Vulnerability from github – Published: 2026-02-01 15:32 – Updated: 2026-02-01 15:32TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.
{
"affected": [],
"aliases": [
"CVE-2020-37063"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-01T15:16:04Z",
"severity": "HIGH"
},
"details": "TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.",
"id": "GHSA-6hrv-vgx8-q9xm",
"modified": "2026-02-01T15:32:31Z",
"published": "2026-02-01T15:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37063"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/48085"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/tftp-turbo-tftp-turbo-unquoted-service-path"
},
{
"type": "WEB",
"url": "https://www.weird-solutions.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6HW7-52J7-XMQ2
Vulnerability from github – Published: 2025-12-19 21:30 – Updated: 2025-12-19 21:30ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceNT service configuration. Attackers with write permissions to Program Files directories can inject a malicious ActSrvNT.exe executable to gain elevated system access when the service restarts.
{
"affected": [],
"aliases": [
"CVE-2023-53954"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-19T21:15:51Z",
"severity": "HIGH"
},
"details": "ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceNT service configuration. Attackers with write permissions to Program Files directories can inject a malicious ActSrvNT.exe executable to gain elevated system access when the service restarts.",
"id": "GHSA-6hw7-52j7-xmq2",
"modified": "2025-12-19T21:30:20Z",
"published": "2025-12-19T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53954"
},
{
"type": "WEB",
"url": "https://www.actfax.com"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51332"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/actfax-unquoted-path-services-privilege-escalation-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6J28-2P63-CR4R
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.
{
"affected": [],
"aliases": [
"CVE-2017-3141"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-16T20:29:00Z",
"severity": "HIGH"
},
"details": "The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2-\u003e9.2.9, 9.3.2-P1-\u003e9.3.6, 9.4.0-\u003e9.8.8, 9.9.0-\u003e9.9.10, 9.10.0-\u003e9.10.5, 9.11.0-\u003e9.11.1, 9.9.3-S1-\u003e9.9.10-S1, 9.10.5-S1.",
"id": "GHSA-6j28-2p63-cr4r",
"modified": "2022-05-13T01:36:46Z",
"published": "2022-05-13T01:36:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3141"
},
{
"type": "WEB",
"url": "https://kb.isc.org/docs/aa-01496"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201708-01"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180926-0001"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42121"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99089"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038693"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6PC5-CCR3-MPQP
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-08-11 00:00A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions), SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES (All versions), Soft Starter ES (All versions). A component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted.
{
"affected": [],
"aliases": [
"CVE-2020-7581"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-14T14:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Opcenter Execution Discrete (All versions \u003c V3.2), Opcenter Execution Foundation (All versions \u003c V3.2), Opcenter Execution Process (All versions \u003c V3.2), Opcenter Intelligence (All versions), Opcenter Quality (All versions \u003c V11.3), Opcenter RD\u0026L (V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions), SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions \u003c V16 Update 2), SIMOCODE ES (All versions), Soft Starter ES (All versions). A component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted.",
"id": "GHSA-6pc5-ccr3-mpqp",
"modified": "2022-08-11T00:00:43Z",
"published": "2022-05-24T17:22:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7581"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6Q59-28X3-V9H7
Vulnerability from github – Published: 2026-01-14 00:31 – Updated: 2026-01-14 00:31Splashtop 8.71.12001.0 contains an unquoted service path vulnerability in the Splashtop Software Updater Service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Splashtop\Splashtop Software Updater\ to inject malicious executables and escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2022-50693"
],
"database_specific": {
"cwe_ids": [
"CWE-428"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-13T23:15:49Z",
"severity": "HIGH"
},
"details": "Splashtop 8.71.12001.0 contains an unquoted service path vulnerability in the Splashtop Software Updater Service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\\Program Files (x86)\\Splashtop\\Splashtop Software Updater\\ to inject malicious executables and escalate privileges.",
"id": "GHSA-6q59-28x3-v9h7",
"modified": "2026-01-14T00:31:27Z",
"published": "2026-01-14T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50693"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51182"
},
{
"type": "WEB",
"url": "https://www.splashtop.com"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/splashtop-unquoted-service-path"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Properly quote the full search path before executing a program on the system.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.