CVE-2026-103845: Dimension | Uncontrolled Search Path Element (CWE-427)
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems on which Dimension is installed are exposed when a local attacker with user permissions can place or influence a search-path element and persuade a victim to run the application. The resulting code execution occurs in the context of the current user.
Does exploitation require prior access or user interaction?
Yes. The attacker needs local access with user permissions, and the victim must run the application. The provided information does not describe a remote or no-interaction exploitation path.
What is the potential impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution with the privileges of the current user. The vulnerability is rated high severity with impacts to confidentiality, integrity, and availability, and its scope is changed.