ModSecurity Multipart Filename Bypass (CVE-2026-104269)

CVE-2026-104269 is a flaw in how ModSecurity reads the filename of an uploaded file. The CVE record says the bug sits in ModSecurity's multipart parser, used by OWASP Core Rule Set rules that inspect uploaded filenames, including rule 920120, 922100 and 922110.

Those rules read the filename from the raw bytes of the Content-Disposition header, through ModSecurity's own MULTIPART_NAME and MULTIPART_FILENAME variables. The CVE record and the GitHub advisory say ModSecurity's parser does not implement RFC 2231. That standard defines an extended filename* parameter with its own character set and language tag.

What an Attacker Gains

A Content-Disposition header can carry a plain filename parameter and an RFC 2231 filename* parameter at the same time. NVD's description says common backend parsers in Go, Python, Node.js and Java prefer the filename* value once both are present. ModSecurity's multipart parser does not, so it keeps reading the plain filename.

The advisory explains the result. An attacker sets a safe-looking name in filename, which ModSecurity scans and allows, and a different name in filename*, which the application's own parser decodes and uses instead. If the application stores the file, checks its extension, or infers its content type from that decoded name, the WAF check never saw the name the application actually used.

The advisory adds that PHP's native multipart parser does not decode filename*, so this specific bypass does not apply to PHP backends. We leave out the advisory's own request example on purpose.

What the Advisory and HKCERT Say About Exploitation

The GitHub advisory includes its own proof-of-concept section for the bypass. HKCERT's 9 November 2026 bulletin says proof-of-concept exploit code is publicly available for CVE-2026-104269, and rates the bulletin's own risk level as Medium. GitHub, the CNA, scores the flaw itself High severity.

How the Score Reads

GitHub, the CNA, scores CVE-2026-104269 at CVSS 3.1 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. NVD lists the same score and vector, with no independent analysis yet; its entry shows status Received. There is no CVSS 4.0 score in the record or NVD.

The CVE record assigns CWE-436, Interpretation Conflict, as the weakness type. The advisory's own overview page lists no CWE at all, so rely on the CVE record for that classification. See our CVSS glossary entry for how to read the vector.

The CVE record lists ModSecurity 3.0.0 and later, before 3.0.17, as affected by CVE-2026-104269. NVD's own description states plainly that the issue is fixed in version 3.0.17. The project's 3.0.17 release notes credit a fix to this advisory's GHSA id.

The GitHub advisory's own overview page still lists no patched version for CVE-2026-104269. That does not match the CVE record or the release notes, so check your running build against the release notes rather than that one field alone.

A Second ModSecurity Advisory From the Same Release

GitHub published a separate advisory the same day, GHSA-jx3r-phvx-2jmj, for CVE-2026-73857. This is a different flaw, not the same bypass: an uninitialized pointer dereference in ModSecurity's XML request body processor, reported to the project by researcher Tobias Klein.

The advisory says a single crafted HTTP request can make a worker process dereference an uninitialized pointer in the XML-into-ARGS code path, writing a constant value to an attacker-controlled address. Impact ranges from denial of service to memory disclosure and possible remote code execution, per the advisory. The flaw is reachable only when the SecParseXmlIntoArgs directive is set to On or OnlyArgs; the advisory says that directive is Off by default.

GitHub scores CVE-2026-73857 at CVSS 3.1 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and lists CWE-787 and CWE-824. The CVE Program had not yet published a formal record for CVE-2026-73857 as of 9 November 2026. GitHub's advisory already names that id and lists 3.0.17 as the patched version.

Neither flaw is in the CISA Known Exploited Vulnerabilities catalog, version 2026.11.06. ModSecurity is the reference engine behind the OWASP Core Rule Set; see our OWASP Top 10 web application risks list for the risks that rule set defends against.

This is not the only flaw where upload handling and WAF inspection read the same request differently. See the PHP session upload progress remote code execution flaw for a similar mismatch in a different stack.