CWE-64 (Windows快捷方式跟随(.LNK)) — Vulnerability Class 9

CWE-64 represents a path traversal vulnerability specific to Windows environments, occurring when applications fail to validate the actual target of a .LNK shortcut file. Attackers typically exploit this weakness by crafting malicious shortcuts that point to sensitive system directories or unauthorized files outside the application’s intended control sphere. When the vulnerable software processes these shortcuts, it inadvertently grants access to resources it should not, potentially leading to data exfiltration, unauthorized modification, or privilege escalation. To mitigate this risk, developers must implement rigorous input validation that resolves symbolic links and shortcuts before processing. This involves checking the final resolved path against a whitelist of allowed directories, ensuring that the application strictly operates only within its designated security boundary and ignores any attempts to redirect execution to external, untrusted locations.