# ModSecurity v3 RFC 2231 filename* Multipart Parser Differential Bypasses WAF Filename Rules (CVE-2026-104269)

> OWASP ModSecurity v3 (>= 3.0.0, < 3.0.17) does not implement RFC 2231 extended parameters in multipart Content-Disposition headers, so a request carrying a benign filename= and a malicious filename*= is inspected as the benign name while RFC-compliant backends (Go, Python, Node.js, Java) use the malicious one. This lets an attacker slip a file such as shell.php past OWASP CRS upload-extension rules. Fixed in 3.0.17; a public PoC payload is published in the vendor advisory.

- **Published:** 2026-11-09T02:57:43Z
- **Last reviewed:** 2026-11-09T02:57:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5517
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5517.png
- **ID:** TL-2026-5517
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-104269

## Description

CVE-2026-104269 (GHSA-5pww-8rfg-9crf, CWE-436 Interpretation Conflict; Red Hat also maps CWE-444) is a parser-differential flaw in the ModSecurity v3 (libmodsecurity) multipart/form-data processor. OWASP Core Rule Set filename rules, including 920120, 922100 and 922110, evaluate filenames taken from the raw Content-Disposition header bytes (surfaced to rules through MULTIPART_FILENAME). ModSecurity's multipart parser does not implement the RFC 2231 parameter extensions, so it only sees the plain filename= value.

RFC-compliant backend parsers prefer the decoded filename* value over filename when both are present. The advisory names Go (mime.ParseMediaType), Python (Werkzeug and Starlette/python-multipart), Node.js (busboy, @fastify/multipart) and Java (Spring ContentDisposition.parse()) as affected consumers. PHP's native multipart handling reads only filename= and is not affected. ModSecurity v2 is reported as outside the affected range.

The vendor advisory's proof of concept is a single header: Content-Disposition: form-data; name="file"; filename="safe.jpg"; filename*=UTF-8''shell.php. ModSecurity/CRS sees safe.jpg and passes it under extension rules, while the backend extracts shell.php. If the application stores the upload under the backend-selected name in a web-served directory, the advisory describes the outcome as remote code execution via a web shell. Applications that use the backend-selected filename for storage, extension checks or content-type inference are therefore exposed.

The flaw is a WAF-evasion primitive, not a standalone code-execution bug: impact depends on the backend framework and on how uploads are stored and served. GHSA/NVD score it CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N). The HKCERT bulletin rates it Medium and lists the impact as Denial of Service, which is inconsistent with its own description. No in-the-wild exploitation is reported, it is not in CISA KEV, and EPSS is about 0.6%. The fix landed in ModSecurity v3.0.17 (released 2026-09-29) as part of a batch of eight security fixes. It corrects handling of filename* and duplicated filename parameters and adds MULTIPART_DUPLICATE_PART_HEADER, MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE variables. Fix commits are 463db0c840fa27bfba095b0406a63004a12884b0 and c6bd53d2dd96766b3afdc35d9929ebb20925d13d. Third-party trackers (Wiz, some distros) still showed 'no fix' at the time of research and the GHSA page listed 'patched versions: none', conflicting with the release notes; verify distro package status. Red Hat lists JBoss Core Services mod_security as affected and RHEL mod_security as under investigation; Debian 12, 13 and sid modsecurity-apache are listed affected.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1211 Exploitation for Stealth
- T1036.008 Masquerade File Type
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Shell Execution — Web Server Worker Spawning Shell/Interpreter (Windows) — C2/Execution** (`TL-2026-5517-SPL-003`)

Sysmon process-creation events where w3wp/httpd/nginx/Tomcat/Node/php-cgi/Python spawn cmd, PowerShell, wscript/cscript/mshta, certutil, whoami or net utilities: web shell command execution following an upload that bypassed ModSecurity via filename* (CVE-2026-104269, TL-2026-5517).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059, T1059.001, T1059.003, T1505.003
- **Data sources:** sysmon (index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1), microsoft_defender_for_endpoint (DeviceProcessEvents)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage IN ("*\\w3wp.exe","*\\httpd.exe","*\\nginx.exe","*\\tomcat9.exe","*\\java.exe","*\\node.exe","*\\php-cgi.exe","*\\python.exe")
    Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\certutil.exe","*\\whoami.exe","*\\net.exe","*\\net1.exe","*\\nltest.exe")
| stats count as executions min(_time) as first_seen values(CommandLine) as commands values(Image) as child_images by host ParentImage ParentCommandLine User
| convert ctime(first_seen)
| sort - executions
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat9.exe", "java.exe", "node.exe", "php-cgi.exe", "python.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server Worker Process Spawns Shell or Interpreter (Web Shell Execution)
id: 2e9a4c68-d0b3-4a57-8f21-6b7c1d3e5a03
status: experimental
description: Detects web server or application worker processes spawning cmd, PowerShell, script hosts or reconnaissance utilities, the typical execution pattern of a web shell such as shell.php uploaded through the CVE-2026-104269 ModSecurity filename* bypass.
references:
    - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
    - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17
    - https://nvd.nist.gov/vuln/detail/CVE-2026-104269
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - attack.persistence
    - attack.t1505.003
    - cve.2026.104269
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat9.exe'
            - '\java.exe'
            - '\node.exe'
            - '\php-cgi.exe'
            - '\python.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\certutil.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate administrative scripts invoked by the application
    - Java or Node applications that shell out to helper utilities
level: high

```

**Known false positives:**

- Applications that legitimately shell out to cmd/PowerShell for housekeeping
- Admin troubleshooting through a web management console

**Tuning notes:** Baseline parent/child pairs for two weeks and allowlist expected ParentCommandLine values such as app pool names. Raise severity when the child command line contains encoded commands or download strings.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Duplicated filename Parameters In Multipart Content-Disposition — WAF Parser Differential — Exploitation (locked: unlock with TL Creds)
- HTTP Access To Script File In Upload Directory (Web Shell Interaction) — Post-Exploitation (locked: unlock with TL Creds)
- Web Shell Staging — Web Server Process Launching Download Cradle or Encoded PowerShell — C2 (locked: unlock with TL Creds)
- Multipart filename* Upload Evaded CRS Filename Rules 920120/922100/922110 — Exploitation (locked: unlock with TL Creds)
- Linux Web Server Process Drops Server-Side Script File (Upload Web Shell) — Post-Exploitation (locked: unlock with TL Creds)
- Linux Web Shell Command Execution — Web Server Spawning Shell/Recon Utilities — C2/Lateral Movement Prep (locked: unlock with TL Creds)
- ModSecurity filename* Multipart WAF Bypass Attempt (CVE-2026-104269) — Exploitation (locked: unlock with TL Creds)
- Web Server Process Drops Server-Side Script (Upload Web Shell via filename* Bypass) — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [HKCERT Security Bulletin: ModSecurity Security Restriction Bypass Vulnerability](https://www.hkcert.org/security-bulletin/modsecurity-security-restriction-bypass-vulnerability_20261109)
- [GitHub Security Advisory GHSA-5pww-8rfg-9crf: RFC 2231 filename* Parameter Bypasses Multipart Filename Rules](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf)
- [ModSecurity v3.0.17 release](https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17)
- [OpenCVE: CVE-2026-104269](https://app.opencve.io/cve/CVE-2026-104269)
- [NVD: CVE-2026-104269](https://nvd.nist.gov/vuln/detail/CVE-2026-104269)
- [Wiz Vulnerability Database: CVE-2026-104269](https://www.wiz.io/vulnerability-database/cve/cve-2026-104269)
- [Cyber Security News: ModSecurity vulnerabilities enable WAF bypass](https://cybersecuritynews.com/modsecurity-vulnerabilities-bypass/)
- [Red Hat Bugzilla 2567712](https://bugzilla.redhat.com/show_bug.cgi?id=2567712)
- [Debian Security Tracker: CVE-2026-104269](https://security-tracker.debian.org/tracker/CVE-2026-104269)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5517