Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114101Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Medium 4.0

In plain English

A medium-severity improper input validation in coraza from corazawaf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/corazawaf/coraza	no fix listed	GO-2026-6691
Go	github.com/corazawaf/coraza/v2	no fix listed	GO-2026-6691
Go	github.com/corazawaf/coraza/v3	3.8.1	GHSA-3wr7-993q-jrff
Go	github.com/corazawaf/coraza/v3	3.8.1	GO-2026-6691

Affected products (as reported)

Vendor	Product	Versions
corazawaf	coraza	0 – before 3.8.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-3wr7-993q-jrff) vendor-advisory
VulnCheck Advisory: Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass third-party-advisory