Insecure Operation on Windows Junction / Mount Point

On Windows NTFS file systems, junction points and mount points are types of symbolic links (reparse points) that can redirect file operations from one directory to another, potentially to a completely different drive or privileged location. If an application with elevated privileges opens a file without checking for these links, an attacker can replace the expected file with a link to a sensitive system file, registry key, or named object, tricking the application into performing unauthorized read, write, or delete operations. This allows privilege escalation or data manipulation because the privileged process unknowingly operates on the attacker's target. For example, an attacker could redirect a file operation to AUTOEXEC.BAT, critical configuration files, or security databases, causing the application to corrupt, expose, or modify sensitive data with its own high-level permissions. Developers must explicitly validate paths and handle reparse points to confine operations within the intended directory scope.