CAPEC-635
Alternative Execution Due to Deceptive Filenames
The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-635: Alternative Execution Due to Deceptive Filenames: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/635.html and https://cve.bz/cve/capec/635?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The use of the file must be controlled by the file extension.
Mitigations
Applications should insure that the content of the file is consistent with format it is expecting, and not depend solely on the file extension.
Weaknesses it exploits
- CWE-162 Improper Neutralization of Trailing Special Elements
Recent CVEs with these weaknesses
- 2.1CVE-2026-47241
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent v…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-165 File Manipulation
MITRE's words, unchanged: CAPEC-635 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.