Coraza WAF EUVD-2026-106904

Exploitation requires three concrete conditions. First, the target must be running Coraza < 3.8.1 configured with FILES / FILES_SIZES-based rules (e.g., CRS file-upload restrictions) to inspect or block upload filenames - if no filename-based rules are in use, there is nothing to bypass. Second, the attacker supplies a Content-Disposition header with a non-utf-8/us-ascii extended parameter, specifically filename*=iso-8859-1''shell.php (optionally with a benign plain 'filename' decoy), exploiting that Go's mime.ParseMediaType silently discards such filename* values. Third - the key limiting factor - the downstream backend application must itself honor the RFC 5987 filename* parameter so that the real (malicious) filename is what actually gets used server-side; backends that only read plain 'filename' do not receive the dangerous name. A secondary variant (filename* alone, no plain filename) causes Coraza to not recognize the part as a file at all, routing it into ARGS and skipping FILES inspection entirely. No authentication is required (PR:N). The practical ceiling on risk is the dependence on backend filename* handling, which is why CVSS rates impact as low.

This is a defense-in-depth bypass, not a direct code-execution flaw, and the signals point to a genuine-but-moderate priority rather than an emergency. The vendor-assigned CVSS:4.0 base score is 6.3 (Medium): AV:N and PR:N/UI:N make it remotely reachable by unauthenticated attackers, but AC:H and AT:P (a specific attack requirement) correctly reflect that successful abuse depends on conditions outside the attacker's control - namely a backend that actually honors the RFC 5987 filename* parameter and a Coraza deployment relying on FILES-based rules for upload filtering. The declared impact is integrity-only and low (VI:L/SI:L, with VC:N/VA:N), consistent with a WAF rule bypass that weakens a security control rather than directly compromising data. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is: no public exploit identified at time of analysis. The flaw was reported by VulnCheck, a credible source, and the GHSA advisory documents verified behavior, so the technical validity is high even though real-world exploitation is unproven. Note the tag 'Information Disclosure' conflicts with the CVSS vector (VC:N = no confidentiality impact); the actual effect is an integrity-side control bypass, so defenders should not treat this as a data-leak issue.

An unauthenticated attacker submits a multipart/form-data file upload to an application fronted by Coraza, supplying a benign decoy 'filename="safe.jpg"' alongside 'filename*=iso-8859-1''shell.php'. Because Go's mime.ParseMediaType silently drops the non-utf-8/us-ascii filename* value, Coraza's FILES rules evaluate only the decoy name and allow the request, while a backend that honors filename* writes shell.php. No public exploit code is identified, but the GHSA advisory documents the exact header constructions that reproduce the bypass.