    def list_zones(self):
        pipe = subprocess.Popen([self.zoneadm_cmd, 'list', '-ip'],
                             cwd=self.runner.basedir,
                             stdin=subprocess.PIPE,
                             stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        #stdout, stderr = p.communicate()
        zones = []
        for l in pipe.stdout.readlines():
          # 1:work:running:/zones/work:3126dc59-9a07-4829-cde9-a816e4c5040e:native:shared
          s = l.split(':')
          if s[1] != 'global':
            zones.append(s[1])

        return zones
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.