CAPEC-649
Adding a Space to a File Extension
An adversary adds a space character to the end of a file extension and takes advantage of an application that does not properly neutralize trailing special elements in file names. This extra space, which can be difficult for a user to notice, affects which default application is used to operate on the file and can be leveraged by the adversary to control execution.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-649: Adding a Space to a File Extension: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/649.html and https://cve.bz/cve/capec/649?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The use of the file must be controlled by the file extension.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability |
Mitigations
File extensions should be checked to see if non-visible characters are being included.
Weaknesses it exploits
- CWE-46 Path Equivalence: 'filename ' (Trailing Space)
Recent CVEs with these weaknesses
- 9.8CVE-2026-8801
Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-635 Alternative Execution Due to Deceptive Filenames
MITRE's words, unchanged: CAPEC-649 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.