{"id":"EUVD-2026-106904","enisaUuid":"e16cf79d-9b39-319a-a3ae-84e7978e41b9","description":"Coraza before 3.8.1 extracts multipart upload filenames with Go\u0027s mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*\u003diso-8859-1\u0027\u0027shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.","datePublished":"Oct 21, 2026, 12:37:03 AM","dateUpdated":"Oct 28, 2026, 1:51:32 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff\nhttps://www.vulncheck.com/advisories/coraza-before-3.8.1-multipart-filename-charset-handling-files-rule-bypass\n","aliases":"CVE-2026-114101\nGHSA-7xj5-pmcw-rwmp\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"5572a9d3-b68c-3538-8bde-30a85ad7b87d","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"0 \u003c3.8.1"}],"enisaIdVendor":[{"id":"f8f5da2f-d334-378e-9377-ac8ebff383b1","vendor":{"name":"corazawaf"}}],"enisaIdVulnerability":[{"id":"44980e2e-e81c-383f-8b67-72e572c39e2d","vulnerability":{"id":"CVE-2026-114101","description":"Coraza before 3.8.1 extracts multipart upload filenames with Go\u0027s mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*\u003diso-8859-1\u0027\u0027shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.","datePublished":"Oct 21, 2026, 12:37:03 AM","dateUpdated":"Oct 28, 2026, 1:51:32 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff\nhttps://www.vulncheck.com/advisories/coraza-before-3.8.1-multipart-filename-charset-handling-files-rule-bypass\n","enisa_id":"EUVD-2026-106904\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Oct 30, 2026, 3:00:59 AM","vulnerabilityProduct":[{"id":"73261e3f-27c8-32e7-9f87-6cc22feb5a2c","product":{"name":"coraza","vendor":{"name":"corazawaf"}},"product_version":"0 \u003c3.8.1"}],"vulnerabilityVendor":[{"id":"2b2381f0-58f6-3192-b731-6aa6f4bbfdd1","vendor":{"name":"corazawaf"}}]}},{"id":"eb00887c-977e-3da3-a019-05f30e3c9b2e","vulnerability":{"id":"GHSA-7xj5-pmcw-rwmp","description":"Coraza before 3.8.1 extracts multipart upload filenames with Go\u0027s mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*\u003diso-8859-1\u0027\u0027shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.","datePublished":"Oct 21, 2026, 3:32:26 AM","dateUpdated":"Oct 21, 2026, 3:32:26 AM","baseScore":0.0,"references":"https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114101\nhttps://www.vulncheck.com/advisories/coraza-before-3.8.1-multipart-filename-charset-handling-files-rule-bypass\n","enisa_id":"EUVD-2026-106904\n","aliases":"GHSA-7xj5-pmcw-rwmp\nCVE-2026-114101\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}