CWE-428— Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.— MITRE CWE catalog

462 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-428page 2 of 10

CVE-2024-58315HIGHCVSS 7.8EG 8.4
2025-12-30
Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting ma…
CVE-2024-34010HIGHCVSS 8.2EG 8.2
2024-04-29
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True …
CVE-2025-41368HIGHCVSS 8.1EG 8.1
2026-03-26
Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permission…
CVE-2021-45460HIGHCVSS 8.1EG 8.1
2022-01-11
A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to pla…
CVE-2020-15261HIGHCVSS 8.0EG 8.0
2020-10-19
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon us…
CVE-2026-81469HIGHCVSS 7.8EG 7.8
2026-09-21
Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and El…
CVE-2020-37254HIGHCVSS 7.8EG 7.8
2026-06-19
Wondershare PDFelement 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService Windows service. Local attackers can place a malicious executable in the service path and execute code with Loca…
CVE-2021-47985HIGHCVSS 7.8EG 7.8
2026-06-19
Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be…
CVE-2022-50971HIGHCVSS 7.8EG 7.8
2026-06-19
Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files i…
CVE-2023-54353HIGHCVSS 7.8EG 7.8
2026-06-19
Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write acces…
CVE-2025-71326HIGHCVSS 7.8EG 7.8
2026-06-19
AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the s…
CVE-2016-20085HIGHCVSS 7.8EG 7.8
2026-06-19
Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable fi…
CVE-2016-20086HIGHCVSS 7.8EG 7.8
2026-06-19
Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path…
CVE-2016-20087HIGHCVSS 7.8EG 7.8
2026-06-19
Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the syst…
CVE-2016-20088HIGHCVSS 7.8EG 7.8
2026-06-19
Comodo Chromodo Browser 52.15.25.664 contains an unquoted service path vulnerability in the ChromodoUpdater service that runs with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitr…
CVE-2016-20089HIGHCVSS 7.8EG 7.8
2026-06-19
Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, a…
CVE-2016-20090HIGHCVSS 7.8EG 7.8
2026-06-19
Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable …
CVE-2016-20091HIGHCVSS 7.8EG 7.8
2026-06-19
Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious executables in the service path. Attackers can place executable files in unquoted pa…
CVE-2016-20092HIGHCVSS 7.8EG 7.8
2026-06-19
NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system r…
CVE-2016-20093HIGHCVSS 7.8EG 7.8
2026-06-19
Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allowing local users to execute arbitrary code with SYSTEM privileges. Attackers can…
CVE-2016-20094HIGHCVSS 7.8EG 7.8
2026-06-19
AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root pa…
CVE-2016-20095HIGHCVSS 7.8EG 7.8
2026-06-19
Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges. Attackers ca…
CVE-2019-25747HIGHCVSS 7.8EG 7.8
2026-06-19
Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that allows local attackers to escalate privileges by placing malicious executables in intermediate directories. Attackers can exploit the unqu…
CVE-2020-37250HIGHCVSS 7.8EG 7.8
2026-06-19
TFTP Broadband 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Progr…
CVE-2020-37251HIGHCVSS 7.8EG 7.8
2026-06-19
RealTimes Desktop Service 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute…
CVE-2020-37252HIGHCVSS 7.8EG 7.8
2026-06-19
Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted se…
CVE-2020-37253HIGHCVSS 7.8EG 7.8
2026-06-19
Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed wi…
CVE-2026-25865HIGHCVSS 7.8EG 7.8
2026-06-18
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe w…
CVE-2021-47974HIGHCVSS 7.8EG 7.8
2026-05-16
VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path dir…
CVE-2020-37247HIGHCVSS 7.8EG 7.8
2026-05-16
Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the …
CVE-2020-37232HIGHCVSS 7.8EG 7.8
2026-05-16
Advanced System Care Service 13.0.0.157 contains an unquoted service path vulnerability in the AdvancedSystemCareService13 service binary path that allows local attackers to escalate privileges. Attackers can place malicious executables in…
CVE-2020-37231HIGHCVSS 7.8EG 7.8
2026-05-16
Privacy Drive 3.17.0 contains an unquoted service path vulnerability in the pdsvc.exe service binary that allows local attackers to escalate privileges by exploiting the service startup process. Attackers can place malicious executables in…
CVE-2020-37230HIGHCVSS 7.8EG 7.8
2026-05-16
Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious execu…
CVE-2020-37229HIGHCVSS 7.8EG 7.8
2026-05-16
OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in the sPSVOpLclSrv service that allows local attackers to escalate privileges by inserting executable files into the unquoted path. Attackers can place a malicio…
CVE-2020-37223HIGHCVSS 7.8EG 7.8
2026-05-13
IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\P…
CVE-2021-47945HIGHCVSS 7.8EG 7.8
2026-05-10
Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in t…
CVE-2026-5789HIGHCVSS 7.8EG 7.8
2026-04-21
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the i…
CVE-2016-20061HIGHCVSS 7.8EG 7.8
2026-04-04
sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can insert a malicious executable in the unquot…
CVE-2016-20060HIGHCVSS 7.8EG 7.8
2026-04-04
Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attackers to escalate privileges by injecting malicious executables. Attackers can place executable files in the service pat…
CVE-2016-20059HIGHCVSS 7.8EG 7.8
2026-04-04
IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted s…
CVE-2016-20058HIGHCVSS 7.8EG 7.8
2026-04-04
Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in th…
CVE-2016-20057HIGHCVSS 7.8EG 7.8
2026-04-04
NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious ex…
CVE-2016-20056HIGHCVSS 7.8EG 7.8
2026-04-04
Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalate privileges by inserting malicious executables. Attackers can place executable…
CVE-2016-20055HIGHCVSS 7.8EG 7.8
2026-04-04
IObit Advanced SystemCare 10.0.2 contains an unquoted service path vulnerability in the AdvancedSystemCareService10 service that allows local attackers to escalate privileges. Attackers can place a malicious executable in the service path …
CVE-2026-34768HIGHCVSS 7.8EG 7.8
2026-04-04
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the execut…
CVE-2025-41359HIGHCVSS 7.8EG 7.8
2026-03-26
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a …
CVE-2017-20218HIGHCVSS 7.8EG 7.8
2026-03-16
Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to execute arbitrary code with elevated privileges by placing malicious executables in the system root path. Additionally, improp…
CVE-2026-25866HIGHCVSS 7.8EG 7.8
2026-03-09
MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the…
CVE-2026-26034HIGHCVSS 7.8EG 7.8
2026-03-05
UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allows an attacker to execute arbitrary code with SYSTEM privileges by causing the application to load …
CVE-2019-25345HIGHCVSS 7.8EG 7.8
2026-02-12
Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malic…

Map vulnerabilities like CWE-428 to your infrastructure

EchelonGraph correlates every CVE — across CWE-428 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →