EUVD-2026-18352
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Lifecycle Timeline
4Tags
Description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
Analysis
OWASP Core Rule Set (CRS) versions prior to 3.3.9 and 4.25.0 allow bypass of file upload restrictions through whitespace-padded filenames, enabling upload of dangerous executable file extensions (.php, .phar, .jsp, .jspx) that should be blocked. Remote attackers can exploit this vulnerability to upload malicious files with high confidence due to the simple nature of the bypass technique (inserting spaces before the file extension), potentially leading to remote code execution depending on web application firewall configuration and application behavior.
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | released | 3.3.9-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 3.3.0-1+deb11u1 | - |
| bullseye (security) | vulnerable | 3.3.4-1~deb11u2 | - |
| bookworm | vulnerable | 3.3.4-1 | - |
| bookworm (security) | vulnerable | 3.3.4-1+deb12u1 | - |
| trixie (security), trixie | vulnerable | 3.3.7-1+deb13u1 | - |
| forky | vulnerable | 3.3.8-1 | - |
| sid | fixed | 3.3.9-1 | - |
| (unstable) | fixed | 3.3.9-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today