Read the docs
TI-2026-85491 Aliases CVE-2026-104269

ModSecurity misreads RFC 2231 filename* values, bypassing WAF rules

Priority LOW 38CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

ModSecurity from 3.0.0 before 3.0.17 ignores the RFC 2231 filename* precedence used by common Go, Python, Node.js and Java parsers (CWE-436). A Content-Disposition header can give ModSecurity a benign filename while the backend uses a different filename* value, so WAF rules and the application check different names. An unauthenticated remote attacker can send such a request and get a file past WAF inspection. PHP's native parser is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.

Why it matters now

EPSS 0.00569 47th percentileScored 2026-11-07
Fix Partial ModSecurity (owasp-modsecurity): 3.0.17Red Hat: 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
owasp-modsecurityModSecurity3.0.0 to before 3.0.173.0.17Patch availableCNA
  • ModSecurity Vendorowasp-modsecurity Affected 3.0.0 to before 3.0.17 Fixed in 3.0.17 Patch available CNA

Remediation

Upgrade ModSecurity to version 3.0.17, which fixes the flaw. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected without a fix, and Red Hat JBoss Core Services with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ModSecurity (owasp-modsecurity) Fixed in 3.0.17

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10Affected—
Red Hat Enterprise Linux 7Affected—
Red Hat Enterprise Linux 8Affected—
Red Hat Enterprise Linux 9Affected—
Red Hat JBoss Core ServicesAffectedNo fix yet

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-104269
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 5

  • TI-2026-37865 ModSecurity: Multipart form-data parser silently strips embedded line breaks from… CVSS 3.1HIGH 8.6
  • TI-2025-40548 FACTION Unauthenticated Custom Extension Upload leads to RCE CVSS 3.1CRITICAL 9.8
  • TI-2022-07517 Path Traversal in ESAPI CVSS 3.1CRITICAL 9.8
  • TI-2026-30581 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators CVSS 4.0HIGH 8.2
  • TI-2026-23748 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings CVSS 4.0HIGH 8.2
  • TI-2025-19980 Libmodsecurity3 has possible bypass of encoded HTML entities CVSS 4.0HIGH 7.9
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences