ModSecurity WAF Vulnerability Allows Attackers to Bypass File Upload Restrictions Using Crafted HTTP Requests
Two high-severity flaws in ModSecurity let attackers bypass upload filters or crash server workers with crafted HTTP requests.
Two high-severity flaws in the open-source ModSecurity web application firewall (WAF) let attackers slip past upload filters or crash server workers with a single crafted HTTP request. Maintainers published both advisories on September 30, 2026. The first flaw, CVE-2026-104269, is a parser mismatch affecting ModSecurity 3.0.0 and later; it allows remote code execution when attackers send filename="safe.jpg"; filename*=UTF-8"shell.php. The second flaw, CVE-2026-73857, is an uninitialized pointer dereference in the XML request body processor, affecting versions 3.0.15, 3.0.16, and the current v3/master branch. The fixed version is 3.0.17.
Unconfirmed: None
- CVE-2026-104269 scores 8.6 (High)
- CVE-2026-73857 scores 7.5 (High)
- Affects ModSecurity 3.0.0 and later
- Fixed in version 3.0.17
- Only triggered when SecParseXmlIntoArgs is On or OnlyArgs
Impact: remote code execution via crafted HTTP requests bypassing file upload restrictions
| Product | Affected | Fixed in |
|---|---|---|
| ModSecurity | 3.0.0 and later | 3.0.17 |
- 1.upgrade to 3.0.17
- 2.validate file extensions and content on the server side
- 3.store uploads outside the web root
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104269 | Multipart filename* mismatch bypass in ModSecurity before 3.0.17 | 8.6 | — | ||
| CVE-2026-73857 | Uninitialized pointer write in ModSecurity XML parsing | 7.5 | — |
From the original article
2 min read at gbhackers.com
Two high-severity flaws in the open-source ModSecurity web application firewall (WAF) let attackers slip past upload filters or crash server workers with a single crafted HTTP request. Maintainers published both advisories on September 30, 2026, as part of a larger batch that also covers multiple ModSecurity vulnerabilities that enable WAF bypass. ModSecurity WAF Vulnerability The […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.