---
id: "CVE-2026-104269"
kind: "vulnerability"
aliases: ["CVE-2026-104269"]
title: "ModSecurity WAF: multipart filename mismatch lets uploads bypass inspection"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache", "file-upload", "iis", "modsecurity", "nginx", "package", "waf"]
not_affected_if: ["modsecurity-3.0.17-or-later", "modsecurity-below-3.0.0", "php-native-multipart"]
published_at: "2026-11-05T16:17:29+00:00"
first_seen_at: "2026-11-05T16:40:01+00:00"
updated_at: "2026-11-05T16:41:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104269", "first_seen_at": "2026-11-05T16:40:01+00:00"}]
exploit_sources: []
---

# ModSecurity WAF: multipart filename mismatch lets uploads bypass inspection

ModSecurity's multipart parser picks a different upload filename than the backend application does when a Content-Disposition header carries both filename and RFC 2231 filename* parameters. An attacker can smuggle a file past WAF rules that check the filename while the application stores or checks a different one.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the ModSecurity version in use, for example with `modsecurity --version` or the installed module package, and look for any version from `3.0.0` up to but not including `3.0.17`.
- Confirm whether your application receives multipart uploads through ModSecurity rules that use MULTIPART_FILENAME.

## Fix

- ModSecurity 3.x: move to `3.0.17` or later.

## Timeline

- 2026-11-05T16:40:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104269

## Documents

- [advisory] Vendor advisory: github.com https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
- [fix] Patch: github.com https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0
- [fix] Patch: github.com https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d
- [fix] Release notes: github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15
- [fix] Release notes: github.com https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17

## From the sources

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_