ModSecurity discloses upload-bypass and crash flaws, one unpatched
Original title: ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
Maintainer airween published two GitHub advisories on September 30 for high-severity ModSecurity flaws affecting deployments with Apache, IIS, and Nginx. CVE-2026-104269, in 3.0.0 and later, lets an unauthenticated attacker bypass multipart filename checks so some backends save an executable upload. No patched version is listed. CVE-2026-73857 can crash a worker or redirect control flow via an uninitialized pointer, but only when SecParseXmlIntoArgs is On or OnlyArgs, which is off by default. The advisory both names 3.0.17 as fixed and says a fix is not yet available.
Unconfirmed: The advisory lists 3.0.17 as patched while also saying a fix is not yet available.
- CVE-2026-104269 is GHSA-5pww-8rfg-9crf; PHP native uploads are not affected.
- Go, Flask, FastAPI, Node.js, and Java Spring prefer the encoded filename*.
- CVE-2026-73857 affects 3.0.15, 3.0.16, and current v3 master, not v2.
- Weaknesses are CWE-787 and CWE-824; the author rates availability impact near 7.5.
- Researchers 0xkalawy, ZeyadZonkorany, and Tobias Klein reported the issues.
Impact: WAF bypass of file checks, or crash and possible code execution
| Product | Affected | Fixed in |
|---|---|---|
| ModSecurity | 3.0.0 and later | — |
| ModSecurity | 3.0.15, 3.0.16, and current v3 master | 3.0.17 |
- 1.Set SecParseXmlIntoArgs to Off until a confirmed fixed release is installed.
- 2.Confirm 3.0.17 on the project page before treating the pointer bug as patched.
- 3.Do not trust client upload names; block script extensions and store files outside the web root.
- Products
- ModSecurity
- Organizations
- OWASP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104269 | Multipart filename* mismatch bypass in ModSecurity before 3.0.17 | 8.6 | — | ||
| CVE-2026-73857 | Uninitialized pointer write in ModSecurity XML parsing | 7.5 | — |
From the original article
3 min read at cybersecuritynews.com
Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx. Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution. ModSecurity inspects web traffic and blocks requests that look […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.