A high-severity flaw in the OWASP ModSecurity web application firewall lets attackers slip dangerous filenames past upload rules, and a working proof-of-concept request is now public.

The flaw, tracked as CVE-2026-104269 and rated 8.6 High, is a parser-differential bug in the ModSecurity v3 multipart form-data processor. It was published by MITRE and the NVD on 5 November, and Hong Kong's HKCERT issued a bulletin on 9 November recommending an upgrade. The OWASP project disclosed the issue on 30 September as advisory GHSA-5pww-8rfg-9crf.

How the bypass works

ModSecurity does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js and Java application parsers. An upload request can present a harmless filename for ModSecurity to inspect, while carrying a different encoded filename* value that the backend application prefers.

The result is that the firewall and the application make security decisions on different names. An attacker could slip a file such as shell.php past OWASP Core Rule Set upload-extension rules, and the advisory warns that in that case the WAF protection is entirely bypassed. PHP's native multipart parser is not affected by the discrepancy.

Fix in ModSecurity 3.0.17

The flaw affects ModSecurity 3.0.0 and later, before version 3.0.17, which was released on 29 September 2026. Administrators should upgrade libmodsecurity to 3.0.17, which corrects the filename* handling and adds new MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE variables.

The same release also fixes a second flaw, CVE-2026-73857, rated 7.5, which can crash a web server worker with a single crafted XML request. No confirmed exploitation of CVE-2026-104269 has been reported, but with public proof-of-concept code available, unpatched servers should be updated without delay.