# Filename interpolated into shell command

User-controlled filenames reaching shell exec, popen, or interpreter command strings without escaping

_Area: Web injection and code execution. Seen in 4 disclosed reports; latest 2026-05-18. Updated 2026-10-23._

## How it works
Code treats a filename as inert data, but the sink it reaches is a parser: a shell, an interpreter command string, or a filename mini-language. The filename is concatenated or interpolated into that string, so characters meaningful to the parser (quotes, `|`, protocol prefixes, clause syntax) are reinterpreted as instructions rather than as part of a path. The broken assumption is "a filename is just a string"; in fact the sink assigns it grammar.

## Where it shows up
- Filenames from uploads, `latest.yml`/update manifests, or user-supplied paths passed into `exec`, `popen`, `system`, or a `-Command`/`-c` string.
- Interpolation into a command line without quoting or argument-array separation.
- Filenames handed to tools like `egrep`/`grep` that treat leading `|` as a command [E3](https://bugbountylibrary.com/r/h1%3A651518.md).
- "Filename" parameters parsed as a mini-language with protocol prefixes, `outfile` clauses, or filters [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md).
- Security checks that shell out and wrap the result in a catch block [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md).

## How to review
Trace every user-influenced filename to its sink. The invariant: the filename must reach the sink as a single, non-reinterpreted argument (argument array, no shell; or strict allowlist/escaping). Check that no shell metacharacter, quote, or leading `|` can change the command's structure. For mini-language parsers, enumerate every clause and confirm each is constrained [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md). For security checks, confirm a parse or execution error fails closed, not open [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md).

## Variants seen
- Filename as mini-language: protocol prefix, `outfile` clause, and filters chained to copy files, make requests, or inject headers [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md).
- Filename interpolated into a PowerShell command string; a quote breaks the call and the catch block skips validation [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md).
- Leading `|` in a filename turns an `egrep` argument into a shell command [E3](https://bugbountylibrary.com/r/h1%3A651518.md).

## Why fixes fail
In [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md) the quoting bug alone would be a parse error, but the fail-open catch converted it into a full signature bypass; fixing only the quoting leaves the fail-open path. Escaping one metacharacter is insufficient when the sink has multiple grammars [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md).

## Impact and severity
High: arbitrary command execution [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md)[E3](https://bugbountylibrary.com/r/h1%3A651518.md), and file copy, SSRF, header injection, and local file exfiltration [E1](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md). Severity rises when the sink runs with elevated privileges or when a security control (signature validation) is bypassed, turning a quoting defect into full RCE [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2026-05-19-cfitsio-weaponized-filenames-html.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html.md
- E3: https://bugbountylibrary.com/r/h1%3A651518.md