Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104269— ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

Quick assessment

Affected
owasp-modsecurity ModSecurity
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ModSecurity 是一款开源、跨平台的 Web 应用防火墙（WAF）引擎，支持 Apache、IIS 和 Nginx。在 3.0.0 至 3.0.17 版本中，ModSecurity 的多部分（multipart）解析器未遵循 RFC 2231 中规定的 参数优先级，而该优先级被 Go、Python、Node.js 和 Java 等常见应用框架的解析器所采用。攻击者可利用 头同时提供：一个对 ModSecurity 而言看似良性的 参数，以及一个经过编码的 值（后端服务通常优先采用后者）。这会导致 ModSe

CVSS 8.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
owasp-modsecurity ModSecurity >= 3.0.0, < 3.0.17 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104269

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
Source: CVE Program / CVE List V5
Vulnerability Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
解释冲突
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
owasp-modsecurity ModSecurity >= 3.0.0, < 3.0.17 -

II. Public POCs for CVE-2026-104269

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104269

请登录查看更多情报信息。

Other References for CVE-2026-104269 (5)

Same Patch Batch · owasp-modsecurity · 2026-11-05 · 4 CVEs total

CVE-2026-73856 8.6 HIGH ModSecurity: Response Body Inspection Bypass
CVE-2026-103932 5.8 MEDIUM ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
CVE-2026-61813 3.7 LOW ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

IV. Related Vulnerabilities

Same product: ModSecurity
Same vendor: owasp-modsecurity
Same weakness: CWE-436