Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-33691OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks
Medium 6.8
In plain English
A medium-severity security flaw in coreruleset from coreruleset. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | modsecurity-crs | 3.3.4-1+deb12u3 | DEBIAN-CVE-2026-33691 |
| Debian:13 | modsecurity-crs | 3.3.7-1+deb13u2 | DEBIAN-CVE-2026-33691 |
| Debian:14 | modsecurity-crs | 3.3.9-1 | DEBIAN-CVE-2026-33691 |
| Ubuntu:22.04:LTS | modsecurity-crs | no fix listed | UBUNTU-CVE-2026-33691 |
| Ubuntu:24.04:LTS | modsecurity-crs | no fix listed | UBUNTU-CVE-2026-33691 |
| Ubuntu:25.10 | modsecurity-crs | no fix listed | UBUNTU-CVE-2026-33691 |
| Ubuntu:26.04:LTS | modsecurity-crs | no fix listed | UBUNTU-CVE-2026-33691 |
| Ubuntu:26.10 | modsecurity-crs | no fix listed | UBUNTU-CVE-2026-33691 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| coreruleset | coreruleset | < 3.3.9>= 4.0.0-rc1, < 4.25.0 |
Weakness: CWE-178 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w x_refsource_CONFIRM
- https://github.com/coreruleset/coreruleset/pull/4546 x_refsource_MISC
- https://github.com/coreruleset/coreruleset/pull/4547 x_refsource_MISC
- https://github.com/coreruleset/coreruleset/pull/4548 x_refsource_MISC
- https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02 x_refsource_MISC
- https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9 x_refsource_MISC
- https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0 x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2026/03/29/2
- http://seclists.org/fulldisclosure/2026/Apr/0
- http://www.openwall.com/lists/oss-security/2026/04/18/4