PATH Environment Variable Hijacking

Path interception occurs when an affected process resolves an unqualified executable name through an environment PATH whose earlier, attacker-controlled directory contains a same-named program. The replacement runs in the invoking process's security context; it does not itself grant elevated privileges. Privilege escalation requires a higher-privileged process to consume the modified PATH.