Skip to content
OpenAdvisories

Weakness (CWE)

CWE-64: Windows Shortcut Following (.LNK)

Variant Incomplete

The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Follow the principle of least privilege when assigning access rights to entities in a software system.

    Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Source: MITRE CWE-64

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-7376

    Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS

    Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubis…

    Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions MC Works64 GENESIS64 ICS / OT
  • Medium 6.7
    CVE-2025-48443

    Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege …

    Trend Micro Trend Micro Password Manager
  • Medium 6.1
    CVE-2021-41562

    Deletion of arbitrary files vulnerability in Snow Agent for Windows

    A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.

    Snow Snow Agent for Windows Windows
  • Medium 6.1
    CVE-2021-39391

    Cross-site Scripting in Beego

    Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.

    github.com/beego/beego/v2 Go
  • Medium 6.6
    CVE-2021-1492

    Duo Authentication Proxy Installer Denial of Service Vulnerability

    The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful, an attacker can ma…

    Cisco Duo Authentication Proxy Network devices
  • Medium —
    GHSA-87mg-h5r3-hw88

    Cross-Site Scripting in bootbox

    All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript. ## Recommendation Sanitize user input being passed…

    bootbox npm
  • Medium 6.1
    CVE-2018-16481

    Cross-Site Scripting in html-pages

    A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering.

    HackerOne html-pages html-pages npm
  • Medium 6.1
    CVE-2012-6708 Public exploit

    Cross-Site Scripting in jquery

    jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

    ruby jquery-rails org.webjars.npm:jquery jQuery Ubuntu Alpine npm Maven NuGet RubyGems