CWE-428Unquoted Search Path or Element

Abstraction: Base · CVEs in our corpus: 452

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.

Last updated: 20 August 2026 13:14 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SA-11 Developer Testing and Evaluation
SA-8 Security and Privacy Engineering Principles
SA-15 Development Process, Standards, and Tools

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2023-38408`	9.9	9.8	0.7970	2023-07-20
`CVE-2019-17658`	7.7	9.8	0.0218	2020-03-12
`CVE-2020-9292`	7.6	9.8	0.0155	2020-06-04
`CVE-2019-8459`	7.5	9.8	0.0119	2019-06-20
`CVE-2022-36344`	7.4	9.8	0.0083	2022-08-16
`CVE-2022-50935`	7.2	9.8	0.0037	2026-01-13
`CVE-2024-24722`	6.9	9.1	0.0061	2024-02-19
`CVE-2020-27644`	6.8	8.8	0.0116	2020-12-29
`CVE-2020-27645`	6.8	8.8	0.0123	2020-12-29
`CVE-2020-15261`	6.6	8.0	0.1125	2020-10-19
`CVE-2023-27298`	6.6	8.8	0.0065	2023-05-10
`CVE-2018-10619`	6.3	7.8	0.0276	2018-06-07
`CVE-2020-5569`	6.3	8.4	0.0036	2020-04-20
`CVE-2021-45460`	6.3	8.1	0.0083	2022-01-11
`CVE-2017-13993`	6.2	7.8	0.0176	2017-10-05
`CVE-2019-18915`	6.2	7.8	0.0148	2020-02-13
`CVE-2023-53965`	6.2	8.4	0.0023	2025-12-22
`CVE-2022-50901`	6.2	8.4	0.0024	2026-01-13
`CVE-2022-50903`	6.2	8.4	0.0024	2026-01-13
`CVE-2016-5793`	6.1	8.8	0.0038	2016-09-24
`CVE-2018-4873`	6.1	7.8	0.0129	2018-05-19
`CVE-2018-16183`	6.1	7.8	0.0133	2019-01-09
`CVE-2019-6008`	6.1	7.8	0.0126	2019-12-26
`CVE-2020-14521`	6.1	8.3	0.0127	2022-02-11
`CVE-2022-23909`	6.1	7.8	0.0103	2022-04-05