Improper Handling of Windows Device Names

Windows reserves certain filenames like AUX, CON, PRN, COM1, and LPT1 for internal device access. When an application accepts user-controlled input for filenames or paths without filtering these names, it may attempt to open a system device instead of a file. This often triggers unexpected errors, leading to application denial of service or revealing internal error details in logs or web responses. Beyond crashes, this flaw can bypass security filters. If an application's validation logic doesn't block these reserved names, an attacker might upload a malicious file disguised as a device name, or inject a device path into a URL parameter. This can disrupt file processing routines, expose stack traces or configuration data, and in some cases, be combined with other weaknesses to execute arbitrary commands.