ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
62
CVE-2026-104269
Multipart filename* mismatch bypass in ModSecurity before 3.0.17
- CVSS 3.1
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply RFC 2231 filename* precedence used by common Go, Python, Node.js, and Java parsers. A remote, unauthenticated attacker can send a benign filename and a different encoded filename* so MULTIPART_FILENAME rules and the app judge different names. Backends that store files, check extensions, or infer type from the selected name can accept a name that skipped WAF inspection. PHP's native multipart parser is not affected.
What to do: Upgrade ModSecurity to 3.0.17. PHP's native multipart parser is not affected by this discrepancy.
| Product | Affected | Fixed in |
|---|---|---|
| ModSecurity | 3.0.0 until 3.0.17 | 3.0.17 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.
- Weakness
- CWE-436
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
In the news
2 storiesModSecurity WAF Vulnerability Allows Attackers to Bypass File Upload Restrictions Using Crafted HTTP Requests
Two high-severity flaws in ModSecurity let attackers bypass upload filters or crash server workers with crafted HTTP requests.
50