EUVD-2026-18352Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
AnalysisAI
OWASP Core Rule Set (CRS) versions prior to 3.3.9 and 4.25.0 allow bypass of file upload restrictions through whitespace-padded filenames, enabling upload of dangerous executable file extensions (.php, .phar, .jsp, .jspx) that should be blocked. Remote attackers can exploit this vulnerability to upload malicious files with high confidence due to the simple nature of the bypass technique (inserting spaces before the file extension), potentially leading to remote code execution depending on web application firewall configuration and application behavior.
Technical ContextAI
OWASP CRS is a ruleset deployed within ModSecurity and compatible Web Application Firewalls (WAFs) to detect and block common web attacks. The vulnerability stems from CWE-178 (Improper Handling of Case Sensitivity in Filenames and File Paths), where the regex patterns used to validate dangerous file extensions do not normalize whitespace characters before evaluation. When a filename like 'photo. php' or 'shell.jsp ' is processed, the regex pattern matching the extension fails because the dot and extension are separated by whitespace, causing the rule to incorrectly classify the file as safe. The affected CPE (cpe:2.3:a:coreruleset:coreruleset:*:*:*:*:*:*:*:*) encompasses all versions prior to the patched releases.
RemediationAI
Upgrade OWASP Core Rule Set to version 3.3.9 or later for the 3.x branch, or version 4.25.0 or later for the 4.x branch. Both patched versions normalize whitespace in filenames before evaluating extension-based rules, preventing the bypass. The patches are available as GitHub releases at https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9 and https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0, with underlying fixes detailed in pull requests #4546, #4547, and #4548. Users should identify their current CRS version in their ModSecurity or WAF deployment, determine the appropriate branch (3.x or 4.x), and update accordingly. Ubuntu and Debian package maintainers should check their respective security advisories for backported patches to stable release versions. No interim workaround is practical given the fundamental nature of the bypass; patching is the recommended and necessary remediation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Authentication Bypass
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | released | 3.3.9-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 3.3.0-1+deb11u1 | - |
| bullseye (security) | vulnerable | 3.3.4-1~deb11u2 | - |
| bookworm | vulnerable | 3.3.4-1 | - |
| bookworm (security) | vulnerable | 3.3.4-1+deb12u1 | - |
| trixie (security), trixie | vulnerable | 3.3.7-1+deb13u1 | - |
| forky | vulnerable | 3.3.8-1 | - |
| sid | fixed | 3.3.9-1 | - |
| (unstable) | fixed | 3.3.9-1 | - |
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today