CWE-64: Windows Shortcut Following (.LNK)
Also known as: Windows symbolic link following, symlink
The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Overview
CWE-64 (Windows Shortcut Following (.LNK)) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.