Incorrect Permission Assignment for Critical Resource

Summary

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if all the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is run as an administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non-default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself. B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. This issue affects pyinstaller versions prior to 5.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.