CVE-2026-104269

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS…

Risk score: 67/100
CVSS: 8.6 v3.1
Published: 5 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: ModSecurity's multipart parser from version 3.0.0 to 3.0.17 does not apply RFC 2231 filename* parameter precedence, allowing a Content-Disposition header to provide a different filename that bypassed WAF inspection. This could allow an attacker to store a file with a name that was not inspected by the WAF.
Affected: {'products': ['ModSecurity'], 'packages': [], 'versions': ['3.0.0', '3.0.1', '3.0.2', '3.0.3', '3.0.4', '3.0.5', '3.0.6', '3.0.7', '3.0.8', '3.0.9', '3.0.10', '3.0.11', '3.0.12', '3.0.13', '3.0.14', '3.0.15', '3.0.16', '3.0.17']}
Fix: Upgrade to version 3.0.17 or later
Exploitation: No known exploitation

Not confirmed. 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8 isn't in the advisory. Check the vendor's advisory before acting on this.

Why it is Amber

CVSS 8.6 high
Remotely exploitable without logging in
On your watchlist: nginx

References

Original description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.

Last activity 5 Nov 2026. Patch Forecast updates every hour.