Preliminary research

When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax

Adrian Denkiewicz · Doyensec

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Examines CFITSIO extended filename syntax behind apparently read-only image operations. Input fetching, output copying, raw-byte conversion and a writable network backend compose into local file writes, server-side requests and byte exfiltration; the walkthrough traces the capabilities activated by filename parsing.

Record

Researcher

Adrian Denkiewicz

Published by

Doyensec

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• CFITSIO BSides Luxembourg presentation
• CFITSIO BSides Luxembourg slides
• CFITSIO demonstration playground

Tags

• ssrf
• file-write
• info-leak
• parser-differential
• attack-chain
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Adrian Denkiewicz, first published at the original source. Preserved copies are kept so the citation survives its host.