Current directory hijack is an attack pattern where software unintentionally loads or executes a file from the folder it is currently running in, instead of a trusted system path. It usually happens when a program starts another tool by bare name, such as git.exe or helper.exe, and relies on the operating system’s search order to find it.
This matters because the working folder may be attacker-controlled, especially when a user opens an untrusted project or extracts a ZIP archive. If a malicious file with the same name is placed there, it can be chosen first and run with the application’s privileges. Defenders reduce the risk by using fully qualified paths, tightening process creation rules, and avoiding insecure search paths. On Windows, this class of bug is closely related to binary shadowing and other executable lookup issues.