Moyenne
4.0
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which...
CVE-2026-114101
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com