Local privilege escalation via PATH-controlled utility execution

Uncontrolled search paths in Raynet RayVentory Scan Engine 12.6 Update 8 and earlier allow local users to execute arbitrary code. The rvia agent invokes helpers such as curl, cat, and sh by relative name and loads shared objects such as libnetselector.so from relative paths, allowing an attacker-controlled PATH to substitute malicious code. Exploitation requires control of the process environment, a condition disputed as a site-specific misconfiguration; the inventory wrapper prevents direct ndtrack library hijacking by resetting PATH.