Protected-directory deletion via followed junctions

Link following in WiX Toolset before 3.14.1 and 4.0.0 through 4.0.4 allows local users to delete protected directories. The RemoveFolderEx custom action recursively registers subdirectories for deletion without rejecting junction reparse points, so Windows Installer follows an attacker-created junction into its protected target. Exploitation requires a per-machine installer configured to remove a per-user tree, a local user who can plant the junction there, and administrator approval of installation or uninstallation; the resulting elevated operation can delete or corrupt protected files.