EIP-2026-117545

This advisory describes a vulnerability in Microsoft Windows .group files where the URL field can be manipulated to execute arbitrary code when a user clicks the 'Website Go' button. The exploit leverages path traversal to point to a malicious executable disguised as a URL.