File Upload Bypass in OWASP Core Rule Set by Inserting Whitespace

CVE-2026-33691

What is CVE-2026-33691?

A file upload bypass vulnerability exists in the OWASP Core Rule Set. This issue arises from a failure to normalize whitespace before evaluating file extensions, allowing attackers to upload files with potentially dangerous extensions such as .php, .phar, .jsp, and .jspx. By exploiting this vulnerability, one can insert whitespace in the filename, resulting in a failure of the dot-extension check. This significantly undermines the security posture of applications utilizing the affected versions of the OWASP CRS. Patches have been released in versions 3.3.9 and 4.25.0 to address this issue effectively.

References