https://seclists.org/oss-sec/2026/q1/406: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability
Published Mar 29, 2026
·Updated
Affected Software
1 affected component
OWASP ModSecurity Core Rule Set (CRS)<3.3.9, <4.25.x, <4.8.x
Frequently Asked Questions
1
What is the severity of CVE-2026-33691?
CVE-2026-33691 has a high severity rating due to its potential to allow attackers to upload harmful files.
2
How do I fix CVE-2026-33691?
To fix CVE-2026-33691, ensure that file upload mechanisms properly validate and sanitize filenames and implement strict whitelisting of accepted file extensions.
3
What types of files can be uploaded due to CVE-2026-33691?
CVE-2026-33691 allows for the upload of potentially dangerous files including .php, .phar, .jsp, and .jspx.
4
Who is affected by CVE-2026-33691?
Users and administrators of the OWASP ModSecurity Core Rule Set (CRS) are affected by CVE-2026-33691.
5
What are the potential impacts of CVE-2026-33691?
The impact of CVE-2026-33691 includes the evasion of security protections, enabling unauthorized file uploads and potentially leading to web server compromise.