A symlink, short for symbolic link, is a special kind of file that points to another file or folder. When a program opens the symlink, the operating system follows it and opens the target instead. Symlinks are widely used to create shortcuts, to switch between versions of a program or to make one directory appear in several places.
They can create security problems when software follows them without checking where they lead. An attacker who can place a symlink in a location that a privileged program reads or writes may trick it into accessing a file outside the intended directory, for example a sensitive configuration file. This weakness often appears when extracting archives or handling uploaded files.
A symlink is not dangerous by itself. The risk depends on whether the program checks the real destination, who can create links in the relevant directory and what permissions the program has. Many vulnerability reports describe a specific scenario, so the effect varies.
Developers should resolve and validate paths before using them, avoid following links for untrusted content, and run with the least privileges needed. Administrators should apply vendor fixes for such flaws and restrict who can write to directories that privileged software reads.