---
title: "HOST-PAM-008 Root PATH Contains Unsafe Entries"
canonical: https://openvapt.com/checks/HOST-PAM-008.html
html: https://openvapt.com/checks/HOST-PAM-008.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PAM-008 Root PATH Contains Unsafe Entries

Checks that the PATH set for root does not include the current directory, empty entries, relative paths or directories other users can write to.

- Domain: Server
- Severity: Medium
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H`
- CIS Controls v8: 4.1
- NIST CSF 2.0: PR.PS-01
- CWE: CWE-426, CWE-427
- NIST SP 800-53 Rev. 5: CM-6, AC-6
- Benchmark topic: Root PATH integrity (CIS Controls v8 4.1) (topic only, no benchmark text)

## Why It Matters

When root's PATH contains . or an empty element, typing ls in a directory an attacker controls runs the attacker's ls as root. A world-writable directory on the PATH has the same effect for every command name that is not found earlier. This is one of the oldest Unix privilege escalations and still common in copied dotfiles.

## How It Detects

Reads PATH= assignments from /root/.bashrc, /root/.profile, /root/.bash_profile, /etc/environment, /etc/profile and /etc/profile.d/*.sh. Entries that are ., empty (a leading, trailing or doubled colon) or relative fail; absolute directories are stat-ed (metadata only) and fail if world-writable or not owned by root. Entries that expand variables ($PATH, $HOME) are not judged. Incomplete when no readable file sets PATH.

## How to Fix

Edit the listed file so PATH holds only absolute, root-owned directories, for example  PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" , remove any . or trailing colon, and  chmod o-w  any listed directory. Log out and in again.

## How to Verify

```
sudo -i sh -c 'echo $PATH'  should show no . or empty element;  ls -ld $(echo $PATH | tr : ' ')
```

## Learn the Theory

- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [MITRE ATT&CK T1574.007, Hijack Execution Flow: Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007/)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go

Run it: `openvapt scan --only HOST-PAM-008`. Read it offline: `openvapt explain HOST-PAM-008`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PAM-008.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.