{"id":"GHSA-3wr7-993q-jrff","kind":"vulnerability","aliases":["GHSA-3wr7-993q-jrff","GO-2026-6691"],"related":[],"title":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza","description":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza","summary":"Coraza, a Go web application firewall library, mishandles multipart filename* (RFC 5987) parameters so a crafted decoy filename can slip past FILES-based rules. An attacker can smuggle a malicious upload through a WAF that inspects uploaded filenames.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/corazawaf/coraza","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/corazawaf/coraza/v3","fixed":["3.8.1"],"affected":"< 3.8.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["coraza","go","package","self-hosted","waf"],"not_affected_if":["no-multipart-file-rules","version-3.8.1-or-later"],"how_to_check":"Check the go.mod of each service for github.com/corazawaf/coraza/v3 and confirm the version is below 3.8.1.\nRun go list -m github.com/corazawaf/coraza/v3 to see the resolved version.","fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.","status":"open","published_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:32+00:00","updated_at":"2026-10-23T20:15:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.\nunknown for the non-v3 module paths: the sources list fixed as '?' for them.","summary":"Coraza, a Go web application firewall library, mishandles multipart filename* (RFC 5987) parameters so a crafted decoy filename can slip past FILES-based rules. An attacker can smuggle a malicious upload through a WAF that inspects uploaded filenames.","category":"package","who_cares":["go","coraza","waf","self-hosted"],"confidence":0.6,"analyst_note":"Confirm whether github.com/corazawaf/coraza (unversioned) and /v2 have a fixed release; sources list fixed as '?'. See https://pkg.go.dev/vuln/GO-2026-6691.","how_to_check":"Check the go.mod of each service for github.com/corazawaf/coraza/v3 and confirm the version is below 3.8.1.\nRun go list -m github.com/corazawaf/coraza/v3 to see the resolved version.","needs_analyst":true,"not_affected_if":["version-3.8.1-or-later","no-multipart-file-rules"],"severity_if_unknown":"unknown"},"cost_usd":0.000423,"input_tokens":2098,"output_tokens":426,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':27A '-6691':28A '/corazawaf/coraza':20A,36A,108C '/corazawaf/coraza/v2':39A '/corazawaf/coraza/v3':42A '3wr7':23A,31A '5987':5A,61B,93C '993q':24A,32A 'applic':54B 'attack':76B 'base':15A,73B,103C 'bypass':12A,100C 'charset':6A,94C 'coraza':1A,43B,50B,89C 'craft':65B 'decoy':10A,66B,98C 'file':14A,72B,102C 'filenam':3A,11A,59B,67B,88B,91C,99C 'files-bas':13A,71B,101C 'firewal':55B 'ghsa':22A,30A 'ghsa-3wr7-993q-jrff':21A,29A 'github.com':19A,35A,38A,41A,107C 'github.com/corazawaf/coraza':18A,34A,106C 'github.com/corazawaf/coraza/v2':37A 'github.com/corazawaf/coraza/v3':40A 'go':26A,44B,52B 'host':48B 'inspect':86B 'jrff':25A,33A 'let':8A,96C 'librari':56B 'malici':80B 'mishandl':57B 'multipart':2A,58B,90C 'packag':45B 'paramet':62B 'past':70B 'restrict':7A,95C 'rfc':4A,60B,92C 'rule':16A,74B,104C 'self':47B 'self-host':46B 'slip':69B 'smuggl':78B 'upload':81B,87B 'waf':49B,84B 'web':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6691","url":"https://pkg.go.dev/vuln/GO-2026-6691","severity":null,"published_at":"2026-10-19T21:08:17+00:00","modified_at":"2026-10-19T21:08:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}