OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| coreruleset | coreruleset | before 3.3.9; 4.0.0-rc1 to before 4.25.0 | 3.3.9, 4.25.0 | Patch available | CNA |
- coreruleset Vendorcoreruleset Affected before 3.3.9; 4.0.0-rc1 to before 4.25.0 Fixed in 3.3.9, 4.25.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:* | before 3.3.9; 4.0.0 to before 4.25.0 | Vulnerable | owasp-modsecurity |
- cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:* Versions before 3.3.9; 4.0.0 to before 4.25.0 Vulnerable ·owasp-modsecurity
Remediation
- Fix · CNA coreruleset (coreruleset) Fixed in 3.3.9, 4.25.0
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33691
- 2026-10-25 EPSS moved to the 90th–95th percentile
References
Patch 5
- https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w
- https://github.com/coreruleset/coreruleset/pull/4546
- https://github.com/coreruleset/coreruleset/pull/4547
- https://github.com/coreruleset/coreruleset/pull/4548
- https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02
Advisory 2
More owasp-modsecurity Owasp Modsecurity Core Rule Set vulnerabilities
- TI-2026-17577 OWASP CRS has multipart bypass using multiple content-type parts CVSS 3.1CRITICAL 9.3
- TI-2022-18921 Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header CVSS 3.1CRITICAL 9.8
- TI-2022-18922 Incorrect authorization in owasp-modsecurity ModSecurity Core Rule Set CVSS 3.1CRITICAL 9.8
- TI-2021-14182 OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before… CVSS 3.1CRITICAL 9.8
- TI-2020-14375 Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection… CVSS 3.1CRITICAL 9.8
- TI-2022-18924 Incorrect authorization in owasp-modsecurity ModSecurity Core Rule Set CVSS 3.1HIGH 7.5
Sources
- CVE-2026-33691 · CVE Program
- CVE-2026-33691 · NVD
- FIRST EPSS
- CVE-2026-33691 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences