CVE-2026-114101

Overview

Coraza WAF versions prior to 3.8.1 incorrectly parse multipart upload filenames, allowing attackers to hide malicious filenames using non‑UTF‑8 charset parameters. This flaw lets dangerous files bypass FILES‑based rules and reach backend systems that honor the filename* attribute. The vulnerability can enable attackers to upload and execute malicious code on the target infrastructure.

Description

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.

Impact

The flaw undermines integrity by permitting the upload of malicious files that can be executed by backend services. Confidentiality is at risk if the uploaded content contains sensitive data or exfiltration code. Availability is not directly affected, but successful exploitation could lead to service compromise. Defenders using Coraza WAF should consider this a potential vector for code injection attacks.

Remediation

Apply Coraza 3.8.1 or later to fix the parsing issue. If an upgrade is not immediately possible, configure the WAF to reject multipart uploads with filename* parameters that are not UTF‑8 or US‑ASCII, or disable filename* handling entirely. Additionally, enforce strict filename validation rules and monitor for anomalous upload activity.

Risk context

The CVSS v3 score of 4.0 indicates a medium severity risk. With no EPSS data available, the urgency remains moderate; defenders should prioritize patching but can mitigate temporarily with configuration changes.

Affected products

• Coraza WAF