{"id":"CVE-2026-104269","summary":"ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)","details":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.","aliases":["GHSA-5pww-8rfg-9crf"],"modified":"2026-11-06T01:21:37.335339491Z","published":"2026-11-05T15:51:18.332Z","database_specific":{"cwe_ids":["CWE-436"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104269.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104269.json"},{"type":"FIX","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0"},{"type":"FIX","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"type":"WEB","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"type":"WEB","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"type":"ADVISORY","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104269"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owasp-modsecurity/modsecurity","events":[{"introduced":"c1cd668acb820824e791ba802396c60900eae9c1"},{"fixed":"1925753989ccce977cdaae417b55c9726c7cf02c"},{"fixed":"463db0c840fa27bfba095b0406a63004a12884b0"},{"fixed":"c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"fixed":"151074aca78a416764b12ba1221e61a17a6c714d"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.0.0"},{"fixed":"3.0.17"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"463db0c840fa27bfba095b0406a63004a12884b0"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"c6bd53d2dd96766b3afdc35d9929ebb20925d13d"}]},{"range":[{"fixed":"151074aca78a416764b12ba1221e61a17a6c714d"}],"source":"REFERENCES_TAG","original_tag":"v2.9.15"},{"source":"REFERENCES_TAG","original_tag":"v3.0.17","range":[{"fixed":"1925753989ccce977cdaae417b55c9726c7cf02c"}]}]}}],"versions":["v3.0.16","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-104269-044e78e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/msc_multipart.c","function":"multipart_process_part_header"},"deprecated":false,"digest":{"function_hash":"56308857746510941646154099105790950546","length":5557}},{"target":{"file":"apache2/msc_multipart.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181288368375911585089525863190000845448","29160699570944174066810108174660822101","77758569666466400662228290522844326075","176967307963386954939226552236395303801","198480082574236009321666379222595490086","218243900386729468330740265153946839589","185381678836484806151238644815464767545","74624317027142978860667459249478534609","93599785298560177639963665918451525077","211761549098374640206527345855203912415","194213410819120406302240306483913361493","22080530929285100258319923152840594182","217462566316334738538163338046520400173","188407880009680172299487171366469391578","104370126165594959525932517703723648960","328205030944725705708472632001612803245","175695967531232858131615642269221565553","257823321820471589835204543873981921754","214360312257237616204289856753923382696","299909592527311222913146955708013776198","137216015559980228341679727694716776841","163176972376994791611983939217601573220","281357068446678541922082999082985384304","52696875585814156116792197227488237720","327886693176660415930344020773679929454","278532532885143030796822790163784800581","37246573313487635640109788636976848221","123556399904879978577923460981245157015","182896698060355980036142442588157524610","279657015043618529691178714750720801316","140067781787589373106742419175935196723","307260498161311081795736751024218755045","271945405617232894787125968336100768160","98844109227792703746452876753263374831","86826772199694754306168980251040105700","190412794591833611749433370954594006501","205983125572027382441555436147902568005","183182025781328379049814748077266299323","27905481209400668523360138486788328351","267697332410898371221141680496807743556","271722072814545602786934260196556491916"]},"id":"CVE-2026-104269-04d98f96","signature_type":"Line","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/msc_multipart.c","function":"multipart_parse_content_disposition"},"deprecated":false,"digest":{"function_hash":"112817149169959535605173830262791313376","length":3177},"id":"CVE-2026-104269-18a48aab","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-104269-1f88eb82","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0","target":{"file":"src/request_body_processor/multipart.cc","function":"Multipart::parse_content_disposition"},"deprecated":false,"digest":{"function_hash":"321130518049355283973875220642798368836","length":4519}},{"source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"function":"var_multipart_filename_generate","file":"apache2/re_variables.c"},"deprecated":false,"digest":{"length":210,"function_hash":"53828602816614011323429035922260899965"},"id":"CVE-2026-104269-2389618b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0","target":{"file":"src/request_body_processor/multipart.cc","function":"Multipart::boundary_characters_valid"},"deprecated":false,"digest":{"length":578,"function_hash":"330559386977266741059775083093642790329"},"id":"CVE-2026-104269-377fa62c"},{"deprecated":false,"digest":{"length":845,"function_hash":"275868046060475032066664230439594374903"},"id":"CVE-2026-104269-3de6bb8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/re_variables.c","function":"var_multipart_strict_error_generate"}},{"digest":{"threshold":0.9,"line_hashes":["148487130232350485130524793699670545570","5202569998189601112350134975259572217","226373612133383281162430209701120683627","179940194439108508557241461884975667860","272574756236909064569300175925734923265","315158504813905608415949123435425142659","112734507780241885773100325847658277410","232621421232674570248537521626762753551","29705950276346438433728152315750987341","312342057635865404216581601677392882561","24456353439263408652103122237635396690","165687390343396469223961473464092542750","232940907512882136191072996922482924148","253795135954498140472273625749566664205","27017642478877065164000264519013889518","203749054793978391870251099679299080503","177257144842503668945075126072742754439","177248029478119800855818520734148304123","239224767538649636823499295396773004260","81567929543715481929347371172607647387","209894854975938528405192162179369800734","3803867300325315412586415924345426224","146057784766785098790482724214351440806","157261903685185776441950043703477723186","113592310620153460747999772114130562805","237486086129796718620215652102711803029","36900995387447423098677475710791776933","208055885334890885400885931386165439869","298509135544834431104924131003534222332","127457589045253652555035153884310073795","38747934203908436891383458482765871053","174777979221688503191179634290322823078"]},"id":"CVE-2026-104269-7ff95e62","signature_type":"Line","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/re_variables.c"},"deprecated":false},{"digest":{"length":17415,"function_hash":"198344636349099981519187244353707977032"},"id":"CVE-2026-104269-9112a686","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/re_variables.c","function":"msre_engine_register_default_variables"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/modsecurity.h"},"deprecated":false,"digest":{"line_hashes":["65783423242000956284861315811786461343","304822891907056078573919138359639709559","303176374441222704770808956685701348014","169337650472129415157076120628266478324","313191381501382023265501242914944725041"],"threshold":0.9},"id":"CVE-2026-104269-cc26767a"},{"digest":{"length":5614,"function_hash":"251453810230046196056899878220861982291"},"id":"CVE-2026-104269-d25f08b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0","target":{"file":"src/request_body_processor/multipart.cc","function":"Multipart::process_part_header"},"deprecated":false},{"source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d","target":{"file":"apache2/msc_multipart.h"},"deprecated":false,"digest":{"line_hashes":["129925274074619421093322675494484688832","287093577140933602951261145560423645275","163403612458206506577598925761668532505","275750512226867890145221377224612239741","194221632005523334803006594946995778283","337282787063510724515402521474698001556","90619705151482102609435467430759057546","196529140353937502691983945685059920826"],"threshold":0.9},"id":"CVE-2026-104269-e9bdd3c3","signature_type":"Line","signature_version":"v1"},{"target":{"file":"apache2/re_variables.c","function":"var_multipart_name_generate"},"deprecated":false,"digest":{"function_hash":"311278085433192019786801298975918912818","length":206},"id":"CVE-2026-104269-ea2ffd35","signature_type":"Function","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/owasp-modsecurity/modsecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0","target":{"file":"src/request_body_processor/multipart.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["282199308163617245345953214317916028373","114337507814361457704957997138701362743","177119550387298995213153168955437729526","262250992318586014509412266689509911866","14625965571838802688494377191440834258","270344424870980732441106078928546105672","99356043633769070667018931306853491720","18269258274329717404498748394681419531","151032374069169387861667395288011468039","97742394079740469167025506600712227389","92878207242256464722260385610765000799","255872838410638484345752770967014979685","331601984186982275337260615486374155193","147312358014707133425082702063159829148","119985852973875077734720055269997582530","118666625918118172549954318711024843822","118201741891545628165334410729145553927","63641138075508684472797258749284260663","119571845048005851148115592762739303735","335320625254059685147248918633023941468","67252347631385029771663454684030971890","22597332563249438324069499115810986229","98771624469984334201111739704059303159","129493119702843588155731665574725120006","154806498632721136594145912581391384233","100687837683758894555801557503767341333","21458184872591033779439311756089590629","242477516283397977699270493130500824700","102378485387745884516402226283711372967","20602680469339064109612635492020931322","175264074117048577155377242076089318037","244161564492483091800812366032581502892","210131672758015006971378693991358457300","272991156256126540827230541589752411643","182918849034710893183583416426789242949","153961047400351456866629537165001728578","211327993413480168164332901751623231288","182989997806230004310992912879015361528","202864038481239671956073634153086806112","179945581167197590859709995129078898278","185183075418123488982534666066372639860","195229790403785008721065718788522694135","198559935455437379071600665465723281089","72139769628699395501643713640856574035","73637324663361994535954166978546469086","248518281449015023787260479715625002285","41678485999919058686737214829975007670","135802480007754219478680967201202924527","317372081254582779228843204485283394782","3171535333731015176022395581656153965","173791853076422243197722436100786488110","67004873231819972512867094643416345266","90440105969891369336214540292893902278","278545878761259790179257054376528051226","188293471661781198633876512092158939766","263466508011412818691310471060521532124","119395943564435613247536376630390468565","159870559646454555922200026810776604445","308145563612719927798611139168816516398"]},"id":"CVE-2026-104269-ec848316"}],"vanir_signatures_modified":"2026-11-06T01:21:37Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104269.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}