CVE-2026-104269: ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename value that the backend prefers, causing MULTIPARTFILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurityto a version that resolves this vulnerability.Fixed in 3.0.17
Event History
Frequently Asked Questions
Which deployments are exposed to this filename-validation bypass?
Deployments using ModSecurity versions 3.0.0 through 3.0.17 with multipart filename rules are exposed when their backend uses RFC 2231 filename* precedence. The affected backend families identified are Go, Python, Node.js, and Java; PHP's native multipart parser is not affected by this discrepancy.
What does an attacker need to send to exploit the issue?
An attacker can send a multipart Content-Disposition header containing both a benign filename parameter and a different RFC 2231-encoded filename* value. ModSecurity may evaluate the benign name while the backend selects the filename* value, requiring no authentication or user interaction according to the supplied vector.
When is the impact most relevant?
The issue is most relevant where the application uses the backend-selected upload name for storage decisions, file-extension checks, or content-type inference. In those cases, a filename that bypassed MULTIPART_FILENAME rule inspection can reach the application.
What is the remediation?
Update ModSecurity to version 3.0.17, which fixes the parser discrepancy.