Multipart Parsing Vulnerability in ModSecurity Web Application Firewall

CVE-2026-104269

What is CVE-2026-104269?

The multipart parsing implementation in ModSecurity versions from 3.0.0 to 3.0.17 fails to enforce proper precedence for the RFC 2231 filename* parameter. This flaw allows a malicious actor to exploit a Content-Disposition header to introduce a benign filename while simultaneously using a different encoded filename* preferred by the backend application. As a result, MULTIPART_FILENAME processing rules may yield an unfiltered filename, thereby creating a potential loophole where security checks are evaded. This issue has been addressed and fixed in version 3.0.17 of ModSecurity.

References