Variant weakness
Incomplete
CWE-64: Windows Shortcut Following (.LNK)
Also known as: Windows symbolic link following, symlink
The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
9
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Low
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
CWE-64 (Windows Shortcut Following (.LNK)) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.