CWE-1386
Insecure Operation on Windows Junction / Mount Point
The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.
Impactr finds and proves whether CWE-1386 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.