{"id":"CVE-2026-104269","kind":"vulnerability","aliases":["CVE-2026-104269"],"related":[],"title":"ModSecurity WAF: multipart filename mismatch lets uploads bypass inspection","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.","summary":"ModSecurity's multipart parser picks a different upload filename than the backend application does when a Content-Disposition header carries both filename and RFC 2231 filename* parameters. An attacker can smuggle a file past WAF rules that check the filename while the application stores or checks a different one.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","file-upload","iis","modsecurity","nginx","package","waf"],"not_affected_if":["modsecurity-3.0.17-or-later","modsecurity-below-3.0.0","php-native-multipart"],"how_to_check":"- Check the ModSecurity version in use, for example with `modsecurity --version` or the installed module package, and look for any version from `3.0.0` up to but not including `3.0.17`.\n- Confirm whether your application receives multipart uploads through ModSecurity rules that use MULTIPART_FILENAME.","fix":"- ModSecurity 3.x: move to `3.0.17` or later.","status":"open","published_at":"2026-11-05T16:17:29+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:18+00:00","updated_at":"2026-11-05T16:41:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:18Z","model":"claude-haiku-5-5","output":{"fix":"- ModSecurity 3.x: move to `3.0.17` or later.","reach":"internet","title":"ModSecurity WAF: multipart filename mismatch lets uploads bypass inspection","impact":"medium","summary":"ModSecurity's multipart parser picks a different upload filename than the backend application does when a Content-Disposition header carries both filename and RFC 2231 filename* parameters. An attacker can smuggle a file past WAF rules that check the filename while the application stores or checks a different one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["modsecurity","waf","apache","nginx","iis","file-upload"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Malicious files bypass WAF filename rules and reach the application.","analyst_note":"","how_to_check":"- Check the ModSecurity version in use, for example with `modsecurity --version` or the installed module package, and look for any version from `3.0.0` up to but not including `3.0.17`.\n- Confirm whether your application receives multipart uploads through ModSecurity rules that use MULTIPART_FILENAME.","plain_action":"","needs_analyst":false,"not_affected_if":["php-native-multipart","modsecurity-below-3.0.0","modsecurity-3.0.17-or-later"],"who_is_affected":"Teams that run ModSecurity 3.x as a web application firewall in front of Apache, IIS or Nginx and that accept file uploads with rules based on MULTIPART_FILENAME. Applications whose backend is PHP's native multipart parser are stated not to be affected by this discrepancy. Systems not running ModSecurity 3.0.0 through 3.0.16 can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4468,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104269':12A,15A '-2026':11A,14A '2231':50B,105C '3.0.0':93C '3.0.17':95C,199C 'affect':189C 'apach':16B,88C 'appli':102C 'applic':37B,68B,83C,117C,148C,156C 'attack':54B 'backend':36B,140C,161C 'backend-select':160C 'benign':127C 'bypass':8A,179C 'carri':45B 'caus':142C 'check':63B,71B,167C 'common':111C 'content':42B,121C,170C 'content-disposit':41B,120C 'content-typ':169C 'cross':80C 'cve':10A,13A 'decis':152C 'differ':31B,73B,134C,154C 'discrep':192C 'disposit':43B,122C 'encod':135C 'engin':86C 'extens':166C 'file':18B,58B 'file-upload':17B 'filenam':4A,33B,47B,51B,65B,106C,128C,136C,144C,177C 'firewal':84C 'fix':196C 'go':112C 'header':44B,123C 'ii':20B,89C 'infer':172C 'inspect':9A,181C 'issu':194C 'java':116C 'let':6A 'make':150C 'mismatch':5A 'modsecur':1A,21B,25B,75C,96C,131C 'multipart':3A,27B,98C,143C,185C 'name':155C,163C 'nativ':184C 'nginx':22B,91C 'node.js':114C 'one':74B 'open':78C 'packag':23B 'paramet':52B,107C,129C 'parser':28B,99C,118C,186C 'past':59B 'php':182C 'pick':29B 'platform':81C 'preced':108C 'prefer':141C 'provid':125C 'python':113C 'receiv':175C 'rfc':49B,104C 'rule':61B,145C 'secur':151C 'select':162C 'smuggl':56B 'sourc':79C 'storag':165C 'store':69B 'therefor':174C 'type':171C 'upload':7A,19B,32B 'use':109C,158C 'valu':137C 'version':198C 'waf':2A,24B,60B,85C,180C 'web':82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run ModSecurity 3.x as a web application firewall in front of Apache, IIS or Nginx and that accept file uploads with rules based on MULTIPART_FILENAME. Applications whose backend is PHP's native multipart parser are stated not to be affected by this discrepancy. Systems not running ModSecurity 3.0.0 through 3.0.16 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","fileupload","high","iis","modsecurity","nginx","package","waf"],"campaign_type":null,"first_public_at":"2026-09-30T07:36:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104269","severity":null,"published_at":"2026-11-05T16:17:29+00:00","modified_at":"2026-11-05T16:17:29+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":77613,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77614,"url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77615,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77611,"url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77617,"url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T07:36:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}