CVE-2026-114101
CVE-2026-114101 · Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.
CVSS 6.3 · Medium · EPSS 0.2% · Public exploit · Fix available
- Published
- Updated
Affected products and versions
coraza
- Versions
- ≥ 0, < 3.8.1: Affected (semver)
- 3.8.1: Not affected (semver)
Update to 3.8.1