Base weakness
Draft
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Last updated
324
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.
Real-world CVEs
324 recorded CVEs are caused by CWE-428 (Unquoted Search Path or Element). The highest-severity and most recent are shown first. 176 new CWE-428 CVEs have been recorded so far in 2026 (50 in 2025).