CVE-2026-104269 · Package
NO FIX YET · SEE WHAT TO DO
ModSecurity's multipart parser picks a different upload filename than the backend application does when a Content-Disposition header carries both filename and RFC 2231 filename* parameters. An attacker can smuggle a file past WAF rules that check the filename while the application stores or checks a different one.
first public Sep 30, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run ModSecurity 3.x as a web application firewall in front of Apache, IIS or Nginx and that accept file uploads with rules based on MULTIPART_FILENAME. Applications whose backend is PHP's native multipart parser are stated not to be affected by this discrepancy. Systems not running ModSecurity 3.0.0 through 3.0.16 can skip it.
Not affected if modsecurity-3.0.17-or-later, modsecurity-below-3.0.0, php-native-multipart
Who cares apache, file-upload, iis, modsecurity, nginx, waf
modsecurity --version or the installed module package, and look for any version from 3.0.0 up to but not including 3.0.17.3.0.17 or later.ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.