UNIX Hard Link

Hard links allow multiple filenames to reference the same underlying data on a Unix-like filesystem. If a privileged application doesn't validate whether a provided path is a hard link, an attacker can replace an expected file with a link to a critical system file (like /etc/shadow). When the application performs operations, it unknowingly acts on the sensitive target instead. This bypasses intended access controls and can lead to privilege escalation or data corruption. For example, a log rotation tool running with elevated permissions might follow a hard link to overwrite a password file. Developers must explicitly check for hard links when handling files that require strict origin validation, especially in security-sensitive contexts.