CWE-426, also called Untrusted Search Path, is a weakness where software looks for files, libraries, or commands using unsafe or ambiguous locations. Instead of calling a program by its full, trusted path, the application may rely on the current directory, PATH environment variable, or other search rules that an attacker can influence.
This matters most when privileged code is involved. If a service, installer, or security client resolves the wrong helper binary or script, a local attacker may be able to replace it with malicious content and gain higher privileges. Defenders reduce the risk by using absolute paths, removing unsafe directories from search order, validating the execution context, and avoiding privileged launches from writable locations. In practice, CWE-426 often appears in local privilege-escalation bugs and in defenses that harden endpoint software against path hijacking.