Windows Shortcut Following (.LNK)

Windows shortcut files (.LNK) contain a reference to a target file or folder, but they are separate objects with their own permissions. An application that fails to resolve the shortcut's final destination before performing operations can be manipulated. An attacker can place a malicious .LNK file in a location the application trusts, but configure it to point to a sensitive system file or a directory they shouldn't have access to, effectively bypassing intended access controls. This allows for unauthorized file reads or writes. For example, an application designed to process user-uploaded files in a sandboxed folder could be tricked into reading the Windows SAM database or overwriting a critical configuration file because it blindly follows the shortcut. The core security failure is not canonicalizing the path to the shortcut's true target and checking if that resolved path is within the allowed scope before proceeding.