CWE-62 (UNIX硬链接) — Vulnerability Class 2

CWE-62 represents a logic flaw where software fails to verify if a file path corresponds to a hard link pointing outside its intended control sphere. This weakness typically allows attackers to bypass security restrictions by creating hard links to sensitive system files or unauthorized directories. When the application opens these links without validation, it inadvertently operates on protected resources, potentially leading to privilege escalation, data leakage, or denial of service. Developers mitigate this risk by implementing strict path canonicalization and verifying that resolved file paths remain within expected boundaries before processing. Additionally, using symbolic links instead of hard links can help, as symbolic links are easier to detect and validate. Ensuring that file operations explicitly check for hard link targets prevents unauthorized access to critical system components and maintains the integrity of the application’s security model.