Skip to navigation

Threat reportVulnerabilityTL-2026-5550

ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857)

highMONITORING

Two ModSecurity v3 advisories were published on 2026-09-30. CVE-2026-104269 (CVSS 8.6) lets attackers bypass OWASP CRS file-upload filename rules by adding an RFC 2231 filename* parameter that ModSecurity ignores but common backends honour. CVE-2026-73857 (CVSS 7.5) is an uninitialized pointer dereference in the XML request body processor, fixed in 3.0.17. First disclosed .

Key facts

IdentifiersTL-2026-5550, CVE-2026-104269, CVE-2026-73857, CVE-2026-21876
Also known asGHSA-5pww-8rfg-9crf, GHSA-jx3r-phvx-2jmj
SeverityHIGH
CVSS8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
First disclosed
Exploitation statusPublic proof-of-concept exploit for a linked CVE
EPSSCVE-2026-21876: 17.3% (97.1th percentile); CVE-2026-104269: 0.5% (47.3th percentile)
Affected productsOWASP ModSecurity ModSecurity v3 (libmodsecurity3) multipart parser; OWASP ModSecurity libmodsecurity3 XML request body processor; OWASP Core Rule Set rules 920120, 922100, 922110 (reduced effectiveness against filename* bypass); Various backends Go net/http, Flask/Werkzeug, FastAPI/Starlette, Node.js busboy, @fastify/multipart, Spring (RFC 2231-compliant parsers; exposure depends on ModSecurity upstream)
Weaknesses (CWE)CWE-436, CWE-787, CWE-824
MITRE ATT&CK techniquesT1036.008 Masquerade File Type, T1059 Command and Scripting Interpreter, T1190 Exploit Public-Facing Application, T1499.004 Application or System Exploitation, T1505.003 Web Shell
MotivationUNKNOWN
Target sectorstechnology, government administration, finance, health, telecoms
Target regionsGlobal
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5550 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ModSecurity Multipart filename*/filename Mismatch Upload Bypass (CVE-2026-104269) - Exploitation

Hunts ModSecurity v3 audit-log transactions where one multipart Content-Disposition carries both filename= and filename*= with different extensions, e.g. filename="safe.jpg"; filename*=UTF-8''shell.php. ModSecurity ignores RFC 2231 filename*, so CRS rules 920120/922100/922110 pass the decoy while Go, Werkzeug, Starlette, busboy, @fastify/multipart and Spring backends store shell.php, enabling web shell upload and RCE (CVSS 8.6).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1211, T1036.008
  • Data sources: modsecurity_audit_log (index=waf sourcetype=modsec:audit), Syslog (Sentinel), modsecurity audit log (Sigma product: modsecurity)
  • Severity: high
  • Confidence: high

Splunk SPL

index=waf sourcetype="modsec:audit" earliest=-24h
```comment
CVE-2026-104269 (GHSA-5pww-8rfg-9crf): ModSecurity v3 ignores RFC 2231 filename*, so CRS rules 920120, 922100 and 922110 only inspect the plain filename. Hunt multipart parts carrying both parameters with different extensions, for example safe.jpg versus filename*=UTF-8 shell.php
```
| where match(_raw, "(?i)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27") AND match(_raw, "(?i)[;\s]filename\s*=\s*\x22?[^;\x22\r\n]+")
| eval star_name=urldecode(replace(_raw, "(?is)^.*?filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27([^;\x22\r\n]+).*$", "\1"))
| eval plain_name=replace(_raw, "(?is)^.*?[;\s]filename\s*=\s*\x22?([^;\x22\r\n]+).*$", "\1")
| eval plain_ext=lower(replace(plain_name, "^.*\.([A-Za-z0-9]+)\s*$", "\1")), star_ext=lower(replace(star_name, "^.*\.([A-Za-z0-9]+)\s*$", "\1"))
| where plain_ext!=star_ext
| eval script_star=if(match(star_ext, "^(php[0-9]?|phtml|phar|jspx?|aspx?|ashx|cgi|pl|py|sh)$"), "yes", "no")
| stats count as attempts earliest(_time) as first_seen latest(_time) as last_seen values(plain_name) as decoy_filename values(star_name) as smuggled_filename values(script_star) as script_extension by host
| convert ctime(first_seen) ctime(last_seen)
| sort - attempts

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where ProcessName has_any ("modsec", "nginx", "httpd", "apache2")
| where SyslogMessage contains "filename*"
| extend PlainName = extract(@'(?i)[;\s]filename\s*=\s*\\?"?([^";\\\r\n]+)', 1, SyslogMessage)
| extend StarName = url_decode(extract(@'(?i)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27([^;"\\\r\n]+)', 1, SyslogMessage))
| where isnotempty(PlainName) and isnotempty(StarName)
| extend PlainExt = tolower(extract(@'\.([A-Za-z0-9]+)\s*$', 1, PlainName)), StarExt = tolower(extract(@'\.([A-Za-z0-9]+)\s*$', 1, StarName))
| where PlainExt != StarExt
| extend ScriptStar = StarExt in ("php","php3","php4","php5","php7","phtml","phar","jsp","jspx","aspx","asp","ashx","cgi","pl","py","sh")
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DecoyFilenames = make_set(PlainName, 10), SmuggledFilenames = make_set(StarName, 10) by Computer, HostIP, ScriptStar
| order by ScriptStar desc, Attempts desc

Sigma

title: ModSecurity Multipart filename* Smuggling - Dual Filename Parameters (CVE-2026-104269)
id: 7c3f1a52-9b0e-4d61-8a47-5f2e90c1b101
status: experimental
description: Detects multipart/form-data parts in ModSecurity audit logs that carry both a plain filename= and an RFC 2231 filename*= parameter, the parser differential used to bypass OWASP CRS rules 920120, 922100 and 922110.
references:
  - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
  - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-jx3r-phvx-2jmj
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.defense-evasion
  - attack.t1211
  - attack.t1036.008
  - cve.2026.104269
logsource:
  product: modsecurity
  service: audit
detection:
  selection_star:
    RequestBody|re: '(?is)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27[^;\x22\r\n]+'
  selection_plain:
    RequestBody|re: '(?is)[;\s]filename\s*=\s*\x22?[^;\x22\r\n]+'
  condition: selection_star and selection_plain
falsepositives:
  - Legitimate browsers or API clients that send non-ASCII filenames using filename* alongside a plain fallback filename whose extension spelling differs
  - Internal QA testing of WAF upload rules
level: high

Known false positives:

  • Clients sending internationalised filenames via filename* with a plain fallback of a different extension spelling (e.g. .jpeg vs .jpg)
  • WAF upload-rule regression tests that deliberately send filename*

Tuning notes: Requires SecAuditEngine with audit parts B and I (request headers and body) so part headers are logged. Adjust index/sourcetype to your ingest. Raise priority when script_extension=yes. Exclude known QA scanner hosts. Pair with server-side filename validation because no ModSecurity fix is listed for CVE-2026-104269.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Image-Decoy filename with Script filename* Upload Smuggling ([indicator] / [indicator]) - Exploitation · unlock with TL Creds
  • Web Server Process Spawns Shell or Recon Utility - Web Shell Command Execution · unlock with TL Creds
  • Web Server Process Executes Downloader or Netcat - Ingress Tool Transfer (T1105) · unlock with TL Creds
  • HTTP 200 for Script File in Upload Directory - Web Shell Access ([indicator]) · unlock with TL Creds
  • Kernel Segfault in libmodsecurity - CVE-2026-73857 XML Processor Crash · unlock with TL Creds
  • Interpreter or Binary Executed From Web Upload Directory - Uploaded Shell Execution · unlock with TL Creds
  • Server-Side Script Created in Web Upload Directory - Web Shell Placement (T1505.003) · unlock with TL Creds
  • Web Server Worker Crashes - ModSecurity XML Body Processor DoS (CVE-2026-73857) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5550.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

CVE-2026-104269 (GHSA-5pww-8rfg-9crf) is a parser-differential flaw in ModSecurity v3's multipart/form-data parser. The OWASP CRS multipart filename rules (920120, 922100 and 922110) read the filename from the raw Content-Disposition header. ModSecurity does not implement RFC 2231, so it never decodes the extended filename* parameter. RFC-compliant backend parsers do, and when both filename and filename* are present they prefer the decoded filename* value. An attacker can send a benign filename="safe.jpg" that passes WAF inspection together with filename*=UTF-8''shell.php, which the backend uses to store the file. If the file lands in a web-accessible directory with script execution enabled, the result is remote code execution through a web shell. The advisory names these backends as affected: Go (mime.ParseMediaType / p.FileName()), Python (Flask/Werkzeug and FastAPI/Starlette via python-multipart), Node.js (busboy, @fastify/multipart) and Java (Spring ContentDisposition.parse()). PHP's native SAPI reads only filename= and is not affected. The advisory lists ModSecurity >= 3.0.0 as affected and lists no patched version or workaround. Some aggregator sources state that 3.0.17 or later carries RFC 2231 handling, but the GHSA itself does not, so treat the fix status as unconfirmed and verify against the project's release notes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (8.6). The advisory shows no CWE, and OpenCVE records CWE-436 (Interpretation Conflict).

CVE-2026-73857 (GHSA-jx3r-phvx-2jmj) is an uninitialized pointer dereference in libmodsecurity3's XML request body processor. The uninitialized pointer is XMLNodes::parsing_ctx_arg, used in the XML-into-ARGS SAX end-element callback. A single crafted HTTP request from an unauthenticated remote attacker makes a worker process write a constant value to an attacker-controlled address, which is a restricted write-what-where primitive. The advisory describes the impact as ranging from denial of service to memory disclosure and possibly execution-flow redirection. The flaw is reachable only when SecParseXmlIntoArgs is set to On or OnlyArgs; the default is Off. The affected code was introduced in v3.0.15, so v3.0.15, v3.0.16 and current v3/master are affected, while earlier 3.0.x releases and v2.x are not. The fix is in 3.0.17. The advisory's CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), scores availability only, even though the text mentions possible code execution. The CWEs are CWE-787 and CWE-824.

The GBHackers article and the GHSA pages report no in-the-wild exploitation and no public weaponized exploit for either flaw. The CVE-2026-104269 advisory does include an example header pattern. CVE-2026-104269 is not recorded in CISA KEV in the sources reviewed. No network IOCs (IPs, domains, hashes) exist for either vulnerability, so no BeaconBeagle C2 correlation applies. The indicators recorded here are behavioral artefacts and affected components.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.008 Masquerade File Type

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Application or System Exploitation

Persistence

T1505.003 Web Shell

Remediation

Patches

  • CVE-2026-73857: libmodsecurity3 3.0.17
  • CVE-2026-104269: no patched version listed in GHSA-5pww-8rfg-9crf

Immediate actions

  • Upgrade libmodsecurity3 to 3.0.17 or later to fix CVE-2026-73857
  • Set SecParseXmlIntoArgs to Off unless XML argument parsing is required
  • Review web and WAF logs for multipart requests containing both filename and filename* parameters
  • Test upload rules with filename* payloads

Workarounds

  • CVE-2026-73857: keep SecParseXmlIntoArgs Off
  • CVE-2026-104269: no vendor workaround listed; enforce backend-side filename validation using the decoded filename*

Longer-term hardening

  • Validate file extensions and content server-side, using the same decoded filename the application uses for storage
  • Store uploads outside the web root and block script execution in upload directories
  • Do not rely on WAF filename rules as the only upload control
  • Track the ModSecurity project for a fix to the RFC 2231 handling in the multipart parser

Affected and fixed versions

  • OWASP ModSecurity — ModSecurity v3 (libmodsecurity3) multipart parser
    Vulnerable versions: >= 3.0.0
    Fixed in: None listed in GHSA-5pww-8rfg-9crf
  • OWASP ModSecurity — libmodsecurity3 XML request body processor
    Vulnerable versions: 3.0.15; 3.0.16; v3/master (before 3.0.17)
    Fixed in: 3.0.17
  • OWASP — Core Rule Set rules 920120, 922100, 922110 (reduced effectiveness against filename* bypass)
    Vulnerable versions: Deployments using ModSecurity v3 multipart parsing
  • Various backends — Go net/http, Flask/Werkzeug, FastAPI/Starlette, Node.js busboy, @fastify/multipart, Spring (RFC 2231-compliant parsers; exposure depends on ModSecurity upstream)
    Vulnerable versions: Backends that prefer filename* over filename

Timeline

  • OWASP CRS publishes CVE-2026-21876 (CVSS 9.3, CWE-794): rule 922110 validated only the last multipart part's charset; fixed in CRS 4.22.0 and 3.3.8. Related prior bypass of the same multipart rule family, separate from CVE-2026-104269.
  • GHSA-5pww-8rfg-9crf lists no patched version and no mitigations for CVE-2026-104269; GHSA-jx3r-phvx-2jmj lists 3.0.17 as patched while its Patches section says the next release will contain the fix, so release status of 3.0.17 is unclear.
  • OWASP ModSecurity publishes GHSA-jx3r-phvx-2jmj (CVE-2026-73857), the XML request body processor uninitialized pointer dereference, rated High (CVSS 7.5). Reported by Tobias Klein by email; fixed in 3.0.17.
  • OWASP ModSecurity publishes GHSA-5pww-8rfg-9crf (CVE-2026-104269), the RFC 2231 filename* multipart parser mismatch, rated High (CVSS 8.6). Credits: 0xkalawy and ZeyadZonkorany (finders), B0YK4 (coordinator).
  • Wiz vulnerability database lists CVE-2026-104269 and CVE-2026-73857; Wiz notes CVE-2026-73857 was still marked Reserved in early October.
  • NVD shows CVE-2026-104269 with status Received, according to a search-result summary of the NVD entry (not fetched directly).
  • GBHackers publishes coverage of both ModSecurity flaws. It reports no active exploitation and no public proof of concept, and recommends server-side filename validation and keeping SecParseXmlIntoArgs Off.

Sources cited

Other reports on CVE-2026-104269

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —. Reviewed .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats