# ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857)

> Two ModSecurity v3 advisories were published on 2026-09-30. CVE-2026-104269 (CVSS 8.6) lets attackers bypass OWASP CRS file-upload filename rules by adding an RFC 2231 filename* parameter that ModSecurity ignores but common backends honour. CVE-2026-73857 (CVSS 7.5) is an uninitialized pointer dereference in the XML request body processor, fixed in 3.0.17.

- **Published:** 2026-11-09T12:37:37Z
- **Last reviewed:** 2026-11-09T12:37:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5550
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5550.png
- **ID:** TL-2026-5550
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-104269, CVE-2026-73857, CVE-2026-21876

## Description

CVE-2026-104269 (GHSA-5pww-8rfg-9crf) is a parser-differential flaw in ModSecurity v3's multipart/form-data parser. The OWASP CRS multipart filename rules (920120, 922100 and 922110) read the filename from the raw Content-Disposition header. ModSecurity does not implement RFC 2231, so it never decodes the extended filename* parameter. RFC-compliant backend parsers do, and when both filename and filename* are present they prefer the decoded filename* value. An attacker can send a benign filename="safe.jpg" that passes WAF inspection together with filename*=UTF-8''shell.php, which the backend uses to store the file. If the file lands in a web-accessible directory with script execution enabled, the result is remote code execution through a web shell. The advisory names these backends as affected: Go (mime.ParseMediaType / p.FileName()), Python (Flask/Werkzeug and FastAPI/Starlette via python-multipart), Node.js (busboy, @fastify/multipart) and Java (Spring ContentDisposition.parse()). PHP's native SAPI reads only filename= and is not affected. The advisory lists ModSecurity >= 3.0.0 as affected and lists no patched version or workaround. Some aggregator sources state that 3.0.17 or later carries RFC 2231 handling, but the GHSA itself does not, so treat the fix status as unconfirmed and verify against the project's release notes. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (8.6). The advisory shows no CWE, and OpenCVE records CWE-436 (Interpretation Conflict).

CVE-2026-73857 (GHSA-jx3r-phvx-2jmj) is an uninitialized pointer dereference in libmodsecurity3's XML request body processor. The uninitialized pointer is XMLNodes::parsing_ctx_arg, used in the XML-into-ARGS SAX end-element callback. A single crafted HTTP request from an unauthenticated remote attacker makes a worker process write a constant value to an attacker-controlled address, which is a restricted write-what-where primitive. The advisory describes the impact as ranging from denial of service to memory disclosure and possibly execution-flow redirection. The flaw is reachable only when SecParseXmlIntoArgs is set to On or OnlyArgs; the default is Off. The affected code was introduced in v3.0.15, so v3.0.15, v3.0.16 and current v3/master are affected, while earlier 3.0.x releases and v2.x are not. The fix is in 3.0.17. The advisory's CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), scores availability only, even though the text mentions possible code execution. The CWEs are CWE-787 and CWE-824.

The GBHackers article and the GHSA pages report no in-the-wild exploitation and no public weaponized exploit for either flaw. The CVE-2026-104269 advisory does include an example header pattern. CVE-2026-104269 is not recorded in CISA KEV in the sources reviewed. No network IOCs (IPs, domains, hashes) exist for either vulnerability, so no BeaconBeagle C2 correlation applies. The indicators recorded here are behavioral artefacts and affected components.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter
- T1036.008 Masquerade File Type
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ModSecurity Multipart filename*/filename Mismatch Upload Bypass (CVE-2026-104269) - Exploitation** (`TL-2026-5550-SPL-001`)

Hunts ModSecurity v3 audit-log transactions where one multipart Content-Disposition carries both filename= and filename*= with different extensions, e.g. filename="safe.jpg"; filename*=UTF-8''shell.php. ModSecurity ignores RFC 2231 filename*, so CRS rules 920120/922100/922110 pass the decoy while Go, Werkzeug, Starlette, busboy, @fastify/multipart and Spring backends store shell.php, enabling web shell upload and RCE (CVSS 8.6).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1211, T1036.008
- **Data sources:** modsecurity_audit_log (index=waf sourcetype=modsec:audit), Syslog (Sentinel), modsecurity audit log (Sigma product: modsecurity)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=waf sourcetype="modsec:audit" earliest=-24h
```comment
CVE-2026-104269 (GHSA-5pww-8rfg-9crf): ModSecurity v3 ignores RFC 2231 filename*, so CRS rules 920120, 922100 and 922110 only inspect the plain filename. Hunt multipart parts carrying both parameters with different extensions, for example safe.jpg versus filename*=UTF-8 shell.php
```
| where match(_raw, "(?i)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27") AND match(_raw, "(?i)[;\s]filename\s*=\s*\x22?[^;\x22\r\n]+")
| eval star_name=urldecode(replace(_raw, "(?is)^.*?filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27([^;\x22\r\n]+).*$", "\1"))
| eval plain_name=replace(_raw, "(?is)^.*?[;\s]filename\s*=\s*\x22?([^;\x22\r\n]+).*$", "\1")
| eval plain_ext=lower(replace(plain_name, "^.*\.([A-Za-z0-9]+)\s*$", "\1")), star_ext=lower(replace(star_name, "^.*\.([A-Za-z0-9]+)\s*$", "\1"))
| where plain_ext!=star_ext
| eval script_star=if(match(star_ext, "^(php[0-9]?|phtml|phar|jspx?|aspx?|ashx|cgi|pl|py|sh)$"), "yes", "no")
| stats count as attempts earliest(_time) as first_seen latest(_time) as last_seen values(plain_name) as decoy_filename values(star_name) as smuggled_filename values(script_star) as script_extension by host
| convert ctime(first_seen) ctime(last_seen)
| sort - attempts
````

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName has_any ("modsec", "nginx", "httpd", "apache2")
| where SyslogMessage contains "filename*"
| extend PlainName = extract(@'(?i)[;\s]filename\s*=\s*\\?"?([^";\\\r\n]+)', 1, SyslogMessage)
| extend StarName = url_decode(extract(@'(?i)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27([^;"\\\r\n]+)', 1, SyslogMessage))
| where isnotempty(PlainName) and isnotempty(StarName)
| extend PlainExt = tolower(extract(@'\.([A-Za-z0-9]+)\s*$', 1, PlainName)), StarExt = tolower(extract(@'\.([A-Za-z0-9]+)\s*$', 1, StarName))
| where PlainExt != StarExt
| extend ScriptStar = StarExt in ("php","php3","php4","php5","php7","phtml","phar","jsp","jspx","aspx","asp","ashx","cgi","pl","py","sh")
| summarize Attempts = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DecoyFilenames = make_set(PlainName, 10), SmuggledFilenames = make_set(StarName, 10) by Computer, HostIP, ScriptStar
| order by ScriptStar desc, Attempts desc
```

### Sigma

```yaml
title: ModSecurity Multipart filename* Smuggling - Dual Filename Parameters (CVE-2026-104269)
id: 7c3f1a52-9b0e-4d61-8a47-5f2e90c1b101
status: experimental
description: Detects multipart/form-data parts in ModSecurity audit logs that carry both a plain filename= and an RFC 2231 filename*= parameter, the parser differential used to bypass OWASP CRS rules 920120, 922100 and 922110.
references:
  - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf
  - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-jx3r-phvx-2jmj
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.defense-evasion
  - attack.t1211
  - attack.t1036.008
  - cve.2026.104269
logsource:
  product: modsecurity
  service: audit
detection:
  selection_star:
    RequestBody|re: '(?is)filename\*\s*=\s*[A-Za-z0-9_-]+\x27[A-Za-z-]*\x27[^;\x22\r\n]+'
  selection_plain:
    RequestBody|re: '(?is)[;\s]filename\s*=\s*\x22?[^;\x22\r\n]+'
  condition: selection_star and selection_plain
falsepositives:
  - Legitimate browsers or API clients that send non-ASCII filenames using filename* alongside a plain fallback filename whose extension spelling differs
  - Internal QA testing of WAF upload rules
level: high

```

**Known false positives:**

- Clients sending internationalised filenames via filename* with a plain fallback of a different extension spelling (e.g. .jpeg vs .jpg)
- WAF upload-rule regression tests that deliberately send filename*

**Tuning notes:** Requires SecAuditEngine with audit parts B and I (request headers and body) so part headers are logged. Adjust index/sourcetype to your ingest. Raise priority when script_extension=yes. Exclude known QA scanner hosts. Pair with server-side filename validation because no ModSecurity fix is listed for CVE-2026-104269.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Image-Decoy filename with Script filename* Upload Smuggling ([indicator] / [indicator]) - Exploitation (locked: unlock with TL Creds)
- Web Server Process Spawns Shell or Recon Utility - Web Shell Command Execution (locked: unlock with TL Creds)
- Web Server Process Executes Downloader or Netcat - Ingress Tool Transfer (T1105) (locked: unlock with TL Creds)
- HTTP 200 for Script File in Upload Directory - Web Shell Access ([indicator]) (locked: unlock with TL Creds)
- Kernel Segfault in libmodsecurity - CVE-2026-73857 XML Processor Crash (locked: unlock with TL Creds)
- Interpreter or Binary Executed From Web Upload Directory - Uploaded Shell Execution (locked: unlock with TL Creds)
- Server-Side Script Created in Web Upload Directory - Web Shell Placement (T1505.003) (locked: unlock with TL Creds)
- Web Server Worker Crashes - ModSecurity XML Body Processor DoS (CVE-2026-73857) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GHSA-5pww-8rfg-9crf - ModSecurity multipart filename parser mismatch (CVE-2026-104269)](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf)
- [GHSA-jx3r-phvx-2jmj - ModSecurity XML request body processor uninitialized pointer dereference (CVE-2026-73857)](https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-jx3r-phvx-2jmj)
- [GBHackers: ModSecurity WAF Vulnerability Allows Attackers to Bypass File Upload Restrictions Using Crafted HTTP Requests](https://gbhackers.com/modsecurity-waf-vulnerability-2/)
- [Wiz Vulnerability Database: CVE-2026-104269](https://www.wiz.io/vulnerability-database/cve/cve-2026-104269)
- [OpenCVE: CVE-2026-104269](https://app.opencve.io/cve/CVE-2026-104269)
- [Wiz Vulnerability Database: CVE-2026-73857](https://www.wiz.io/vulnerability-database/cve/cve-2026-73857)
- [Security Online CVE Watchtower: CVE-2026-73857](https://securityonline.info/cve-watchtower/cve-2026-73857)
- [Debian Security Tracker: CVE-2026-73857](https://security-tracker.debian.org/tracker/CVE-2026-73857)
- [Debian Security Tracker: CVE-2026-104269](https://security-tracker.debian.org/tracker/CVE-2026-104269)
- [WAFFLED: Exploiting Parsing Discrepancies to Bypass Web Application Firewalls (arXiv 2503.10846)](https://arxiv.org/abs/2503.10846)
- [OWASP CRS: CVE-2026-21876 multipart charset bypass fixed in CRS 4.22.0 and 3.3.8 (related rule 922110 bypass)](https://coreruleset.org/20260106/cve-2026-21876-critical-multipart-charset-bypass-fixed-in-crs-4.22.0-and-3.3.8/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5550