Live › vulnerability › CVE-2026-114101
Go to dashboardCoraza before 3.8.1 reads multipart upload filenames with Go's mime.ParseMediaType, which silently drops RFC 5987 filename* parameters that use a charset other than utf-8 or us-ascii. An unauthenticated attacker can send a decoy filename while the real name sits in filename*, so the WAF's file rules never see the dangerous name and it reaches a backend that honors filename*.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Coraza as a web application firewall with file-upload rules (FILES, FILES_NAMES) in front of an application that accepts multipart uploads. Exposure depends on the backend honoring the RFC 5987 filename* parameter; systems without Coraza, or without upload rules, can skip it.
No product ranges from the sources yet.
grep coraza go.mod); affected if below 3.8.13.8.1 or later (go get github.com/corazawaf/coraza/[email protected])Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.
This page as .md · .json · in your agent: get_signal("CVE-2026-114101")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.