Uncontrolled Search Path Element Vulnerability in MobaXterm by Mobatek

CVE-2026-25866

What is CVE-2026-25866?

MobaXterm prior to version 26.1 is affected by a vulnerability that arises from an uncontrolled search path element. When opening remote files, the application utilizes WinExec to launch Notepad++ without specifying a fully qualified executable path. This oversight permits an attacker to exploit the search path behavior by positioning a malicious executable earlier in the search order. As a result, arbitrary code can be executed within the context of the affected user, posing significant security risks.

References