cve.bz

CWE-64: Windows Shortcut Following (.LNK)

Filter

The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

What the weakness is: CWE-64 at MITRE. All weaknesses

Ask an AI about CWE-64

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-64: Windows Shortcut Following (.LNK) and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/64.html and https://cve.bz/cve/cwe/64?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.9CVE-2025-7376EPSS 0.2%

    Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3…

  2. 7.8CVE-2025-53503EPSS 0.3%

    Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

  3. 7.8CVE-2025-52837EPSS 0.2%

    Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any …

  4. 7.1CVE-2025-52521EPSS 0.4%

    Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

  5. 7.1CVE-2025-49385EPSS 0.2%

    Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

  6. 7.1CVE-2025-49384EPSS 0.2%

    Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

  7. 6.6CVE-2025-48443EPSS 0.2%

    Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allow a local attacker to leverage this vulnerability to delete files in the context…

  8. 6.1CVE-2021-41562EPSS 0.3%

    A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.

  9. 7.1CVE-2021-1492EPSS 0.3%

    The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful…