header-injection 1 When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax May 18, 2026