ModSecurity v3 RFC 2231 filename* Multipart Parser Differential Bypasses WAF Filename Rules (CVE-2026-104269)

Key facts for ModSecurity filename* WAF bypass

Detection coverage for ModSecurity filename* WAF bypass

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5517 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Shell Execution — Web Server Worker Spawning Shell/Interpreter (Windows) — C2/Execution

Sysmon process-creation events where w3wp/httpd/nginx/Tomcat/Node/php-cgi/Python spawn cmd, PowerShell, wscript/cscript/mshta, certutil, whoami or net utilities: web shell command execution following an upload that bypassed ModSecurity via filename* (CVE-2026-104269, TL-2026-5517).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059, T1059.001, T1059.003, T1505.003
• Data sources: sysmon (index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1), microsoft_defender_for_endpoint (DeviceProcessEvents)
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage IN ("*\\w3wp.exe","*\\httpd.exe","*\\nginx.exe","*\\tomcat9.exe","*\\java.exe","*\\node.exe","*\\php-cgi.exe","*\\python.exe")
    Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\certutil.exe","*\\whoami.exe","*\\net.exe","*\\net1.exe","*\\nltest.exe")
| stats count as executions min(_time) as first_seen values(CommandLine) as commands values(Image) as child_images by host ParentImage ParentCommandLine User
| convert ctime(first_seen)
| sort - executions

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat9.exe", "java.exe", "node.exe", "php-cgi.exe", "python.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Web Server Worker Process Spawns Shell or Interpreter (Web Shell Execution)
id: 2e9a4c68-d0b3-4a57-8f21-6b7c1d3e5a03
status: experimental
description: Detects web server or application worker processes spawning cmd, PowerShell, script hosts or reconnaissance utilities, the typical execution pattern of a web shell such as shell.php uploaded through the CVE-2026-104269 ModSecurity filename* bypass.
references:
    - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
    - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17
    - https://nvd.nist.gov/vuln/detail/CVE-2026-104269
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - attack.persistence
    - attack.t1505.003
    - cve.2026.104269
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat9.exe'
            - '\java.exe'
            - '\node.exe'
            - '\php-cgi.exe'
            - '\python.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate administrative scripts invoked by the application
    - Java or Node applications that shell out to helper utilities
level: high

Known false positives:

• Applications that legitimately shell out to cmd/PowerShell for housekeeping
• Admin troubleshooting through a web management console

Tuning notes: Baseline parent/child pairs for two weeks and allowlist expected ParentCommandLine values such as app pool names. Raise severity when the child command line contains encoded commands or download strings.

• 🔒 Duplicated filename Parameters In Multipart Content-Disposition — WAF Parser Differential — Exploitation · unlock with TL Creds
• 🔒 HTTP Access To Script File In Upload Directory (Web Shell Interaction) — Post-Exploitation · unlock with TL Creds
• 🔒 Web Shell Staging — Web Server Process Launching Download Cradle or Encoded PowerShell — C2 · unlock with TL Creds
• 🔒 Multipart filename* Upload Evaded CRS Filename Rules 920120/922100/922110 — Exploitation · unlock with TL Creds
• 🔒 Linux Web Server Process Drops Server-Side Script File (Upload Web Shell) — Post-Exploitation · unlock with TL Creds
• 🔒 Linux Web Shell Command Execution — Web Server Spawning Shell/Recon Utilities — C2/Lateral Movement Prep · unlock with TL Creds
• 🔒 ModSecurity filename* Multipart WAF Bypass Attempt (CVE-2026-104269) — Exploitation · unlock with TL Creds
• 🔒 Web Server Process Drops Server-Side Script (Upload Web Shell via filename* Bypass) — Post-Exploitation · unlock with TL Creds

Indicators of compromise for ModSecurity filename* WAF bypass

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5517.

How ModSecurity filename* WAF bypass works

This lets an attacker slip a file such as shell.php past OWASP CRS upload-extension rules. Fixed in 3.0.17; a public PoC payload is published in the vendor advisory.

CVE-2026-104269 (GHSA-5pww-8rfg-9crf, CWE-436 Interpretation Conflict; Red Hat also maps CWE-444) is a parser-differential flaw in the ModSecurity v3 (libmodsecurity) multipart/form-data processor. OWASP Core Rule Set filename rules, including 920120, 922100 and 922110, evaluate filenames taken from the raw Content-Disposition header bytes (surfaced to rules through MULTIPART_FILENAME). ModSecurity's multipart parser does not implement the RFC 2231 parameter extensions, so it only sees the plain filename= value.

RFC-compliant backend parsers prefer the decoded filename* value over filename when both are present. The advisory names Go (mime.ParseMediaType), Python (Werkzeug and Starlette/python-multipart), Node.js (busboy, @fastify/multipart) and Java (Spring ContentDisposition.parse()) as affected consumers. PHP's native multipart handling reads only filename= and is not affected. ModSecurity v2 is reported as outside the affected range.

The vendor advisory's proof of concept is a single header: Content-Disposition: form-data; name="file"; filename="safe.jpg"; filename*=UTF-8''shell.php. ModSecurity/CRS sees safe.jpg and passes it under extension rules, while the backend extracts shell.php. If the application stores the upload under the backend-selected name in a web-served directory, the advisory describes the outcome as remote code execution via a web shell. Applications that use the backend-selected filename for storage, extension checks or content-type inference are therefore exposed.

The flaw is a WAF-evasion primitive, not a standalone code-execution bug: impact depends on the backend framework and on how uploads are stored and served. GHSA/NVD score it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). The HKCERT bulletin rates it Medium and lists the impact as Denial of Service, which is inconsistent with its own description. No in-the-wild exploitation is reported, it is not in CISA KEV, and EPSS is about 0.6%. The fix landed in ModSecurity v3.0.17 (released 2026-09-29) as part of a batch of eight security fixes. It corrects handling of filename* and duplicated filename parameters and adds MULTIPART_DUPLICATE_PART_HEADER, MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE variables. Fix commits are 463db0c840fa27bfba095b0406a63004a12884b0 and c6bd53d2dd96766b3afdc35d9929ebb20925d13d. Third-party trackers (Wiz, some distros) still showed 'no fix' at the time of research and the GHSA page listed 'patched versions: none', conflicting with the release notes; verify distro package status. Red Hat lists JBoss Core Services mod_security as affected and RHEL mod_security as under investigation; Debian 12, 13 and sid modsecurity-apache are listed affected.

MITRE ATT&CK techniques by tactic:

Stealth

T1036.008 Masquerade File Type; T1211 Exploitation for Stealth

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Remediation for ModSecurity filename* WAF bypass

Patches

• ModSecurity v3.0.17 (fix commits 463db0c840fa27bfba095b0406a63004a12884b0 and c6bd53d2dd96766b3afdc35d9929ebb20925d13d)
• Track distro advisories (Debian modsecurity-apache, Red Hat JBoss Core Services mod_security, Ubuntu) for backported packages

Immediate actions

• Upgrade ModSecurity v3 (libmodsecurity) to 3.0.17 or later
• Add a custom ModSecurity rule to flag or block multipart Content-Disposition headers containing filename*=
• Hunt WAF/audit logs and web server logs for multipart requests with both filename= and filename*= parameters
• Review recently uploaded files in web-accessible directories for unexpected extensions such as .php, .jsp, .aspx

Workarounds

• Configure the backend to ignore filename* and use only filename=
• Reject uploads whose Content-Disposition contains filename*
• Keep upload directories non-executable and not served by the web server

Longer-term hardening

• Validate the final filename and extension on the backend, independent of the WAF
• Store uploads under server-generated names outside web-accessible and executable directories
• Do not rely on WAF upload-extension rules as the sole control; enforce content-type and magic-byte validation server-side
• Use the new MULTIPART_DUPLICATE_PART_HEADER, MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE variables in CRS-based rules after upgrading

Affected and fixed versions

• OWASP — ModSecurity (libmodsecurity v3)
  Vulnerable versions: >= 3.0.0, < 3.0.17
  Fixed in: 3.0.17
• Red Hat — JBoss Core Services (jbcs-httpd24-mod_security)
  Vulnerable versions: Affected per Red Hat tracker
• Debian — modsecurity-apache
  Vulnerable versions: Debian 12; Debian 13; sid

Timeline of ModSecurity filename* WAF bypass

• 2026-09-29 ModSecurity v3.0.17 released by maintainers, fixing filename* and duplicated filename handling in multipart Content-Disposition plus seven other security issues.
• 2026-09-30 GitHub Security Advisory GHSA-5pww-8rfg-9crf published, rated High (CVSS 8.6) with a public proof-of-concept header; credits 0xkalawy and ZeyadZonkorany (finders) and B0YK4 (coordinator).
• 2026-10-01 CVE-2026-104269 reserved by the GitHub CNA; Cyber Security News reports on the batch of ModSecurity bypass advisories including the filename* parsing mismatch.
• 2026-10-05 Debian tracker entries for CVE-2026-104269 added; Debian 12, 13 and sid locked-ioc-3 listed affected.
• 2026-11-05 CVE-2026-104269 published by MITRE/CNA and NVD (status Received) with CWE-436 and CVSS 3.1 8.6.
• 2026-11-06 Red Hat records the CVE (Bugzilla 2567712): JBoss Core Services mod_security affected, RHEL mod_security under investigation.
• 2026-11-09 HKCERT publishes a Medium-risk bulletin recommending upgrade to ModSecurity 3.0.17 and noting public PoC code.

Sources cited for ModSecurity filename* WAF bypass

• HKCERT Security Bulletin: ModSecurity Security Restriction Bypass Vulnerability hkcert.org · Advisory · 2026-11-09
• GitHub Security Advisory GHSA-5pww-8rfg-9crf: RFC 2231 filename* Parameter Bypasses Multipart Filename Rules GitHub · Advisory · 2026-09-30
• NVD: CVE-2026-104269 NVD (NIST) · Advisory · 2026-11-05
• ModSecurity v3.0.17 release GitHub · Vendor report · 2026-09-29
• OpenCVE: CVE-2026-104269 app.opencve.io · Research · 2026-11-05
• Wiz Vulnerability Database: CVE-2026-104269 Wiz · Research · 2026-11-05
• Red Hat Bugzilla 2567712 bugzilla.redhat.com · Vendor report · 2026-11-06
• Debian Security Tracker: CVE-2026-104269 security-tracker.debian.org · Vendor report · 2026-10-05
• Cyber Security News: ModSecurity vulnerabilities enable WAF bypass cybersecuritynews.com · News · 2026-10-01

More in vulnerability

• Critical React Server Components Flaw Enables Unauthenticated Remote Code Execution (GHSA-xqc2-xf4c-x3h3)
• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)