# Symlink redirect of privileged file operation

Privileged delete, write, or move resolving a path through a symlink, junction, or reparse point

_Area: Memory corruption and native code. Seen in 10 disclosed reports; 5 confirmed bounties, median $250, range $250-$30,500; latest 2026-06-01. Updated 2026-10-23._

## How it works
A privileged component (SYSTEM service, installer, AV, or a process impersonating a user) builds a filesystem path from data a low-privileged user controls — an environment variable, a writable directory, a placeholder file, or a device map — then performs a delete, write, move, or load on it. The code assumes the path resolves to the intended location. If any component of that path is a symlink, junction, mount point, or other reparse point, the kernel follows it and the privileged operation lands on a protected target. The broken assumption is that a path string identifies a fixed object; in reality it identifies whatever the reparse point currently points at. The same holds for POSIX symlinks [E2](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html.md).

## Where it shows up
- Privileged code reading paths from `PROGRAMDATA`, `APPDATA`, `TEMP`, or other user-influenced env vars [E5](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-03-21-windows-installer-html.md).
- Debug/logging env vars (e.g. `SQLITE_SQLLOG_DIR`) causing writes with predictable filenames [E2](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html.md).
- Impersonated processes resolving paths without `OBJ_IGNORE_IMPERSONATED_DEVICEMAP` [E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-41073.md).
- Cleanup, rollback, quarantine-restore, or quarantine-delete flows running as SYSTEM [E3](https://bugbountylibrary.com/r/h1%3A858598.md)[E5](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-03-21-windows-installer-html.md)[E6](https://bugbountylibrary.com/r/h1%3A980500.md)[E7](https://bugbountylibrary.com/r/h1%3A996576.md).
- Fixes that block symlinks but not directory junctions or mount points [E6](https://bugbountylibrary.com/r/h1%3A980500.md)[E7](https://bugbountylibrary.com/r/h1%3A996576.md).
- Security products whitelisting a path rather than a handle/inode [E8](https://bugbountylibrary.com/r/h1%3A1003007.md).

## How to review
Identify every privileged file operation and trace how its path is constructed. The invariant: before acting, the privileged code must resolve the final object by handle and confirm no reparse point was traversed, or open with flags that refuse reparse points (`FILE_FLAG_OPEN_REPARSE_POINT`, `O_NOFOLLOW`), or operate on an already-open handle rather than re-resolving a path. Grep for `GetFinalPathNameByHandle` to confirm the resolved object is checked. Check the path is not derived from user-writable state, and that impersonation is either applied or explicitly excluded from path resolution. Separately, treat check-then-use as its own step: confirm the target is locked (e.g. `flock`) so it cannot be swapped between check and use [E7](https://bugbountylibrary.com/r/h1%3A996576.md).

## Variants seen
- Env-var-driven debug write following symlinks to overwrite a protected DB [E2](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html.md).
- Impersonation + user-remapped drive letter redirecting manifest/DLL load [E4](https://bugbountylibrary.com/r/p0%3ACVE-2022-41073.md).
- Installer rollback move via poisoned `PROGRAMDATA` and junction [E5](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-03-21-windows-installer-html.md).
- Quarantine copy into a user-writable folder following a hardlink [E3](https://bugbountylibrary.com/r/h1%3A858598.md).
- Cleanup service deleting through a junction [E7](https://bugbountylibrary.com/r/h1%3A996576.md).
- Folder rename swapping a whitelisted path for a symlink before delete [E8](https://bugbountylibrary.com/r/h1%3A1003007.md).
- Quarantine restore traversing a junction into Startup [E6](https://bugbountylibrary.com/r/h1%3A980500.md).
- Defender remediation write-back through a junction into System32 [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-redsun-exploiting-windows-defenders.md).

## Why fixes fail
Blocking symlinks alone leaves junctions and mount points open [E6](https://bugbountylibrary.com/r/h1%3A980500.md)[E7](https://bugbountylibrary.com/r/h1%3A996576.md). Whitelisting a path instead of a handle lets a rename swap the target [E8](https://bugbountylibrary.com/r/h1%3A1003007.md).

## Impact and severity
Arbitrary file delete/write or code execution as SYSTEM, and TCC bypass on macOS [E2](https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html.md). Severity is high because the primitive is a full privilege boundary crossing; it worsens when the operation is a delete of a driver or config file, or a write into an autostart location [E6](https://bugbountylibrary.com/r/h1%3A980500.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-redsun-exploiting-windows-defenders.md
- E2: https://bugbountylibrary.com/r/blog%3Agergelykalman-com-sqlol-cve-2023-32422-a-macos-tcc-bypass-html.md
- E3: https://bugbountylibrary.com/r/h1%3A858598.md
- E4: https://bugbountylibrary.com/r/p0%3ACVE-2022-41073.md
- E5: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-03-21-windows-installer-html.md
- E6: https://bugbountylibrary.com/r/h1%3A980500.md
- E7: https://bugbountylibrary.com/r/h1%3A996576.md
- E8: https://bugbountylibrary.com/r/h1%3A1003007.md