Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-114101

Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

corazawaf coraza

Default version status: unaffected

  • 0 to < 3.8.1affected
  • 3.8.1unaffected
pkg:golang/github.com/corazawaf/coraza/v3

References