CVE-2026-114101: Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename=iso-8859-1''shell.php, or filename alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Deployments using Coraza before 3.8.1 are exposed where FILES-based rules are relied on to inspect or block multipart upload filenames. The bypass matters when the upload backend honors RFC 5987 filename* parameters.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker must be able to submit a multipart upload and can use a filename* parameter with an unsupported charset such as iso-8859-1, or provide filename* alone, to keep the filename from being seen by FILES-based rules.
How can I determine whether my rules are affected?
Review whether Coraza is below 3.8.1 and whether FILES-based rules enforce filename restrictions for multipart uploads. Test handling of multipart requests containing filename*=iso-8859-1''shell.php or a filename* parameter without a regular filename value, especially if the backend honors filename*.