URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a document containing such links is opened. This occurs because the check for the package content provider does not recognize all naming variations, allowing certain URLs to bypass the check and trigger the expansion.