Preliminary research

When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax

Adrian Denkiewicz · Doyensec

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Examines CFITSIO extended filename syntax behind apparently read-only image operations. Input fetching, output copying, raw-byte conversion and a writable network backend compose into local file writes, server-side requests and byte exfiltration; the walkthrough traces the capabilities activated by filename parsing.

Record

Researcher

Adrian Denkiewicz

Published by

Doyensec

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• CFITSIO BSides Luxembourg presentation
• CFITSIO BSides Luxembourg slides Whitepaper
• CFITSIO demonstration playground

Tags

• ssrf
• file-write
• info-leak
• parser-differential
• attack-chain
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Adrian Denkiewicz, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.