{"schema":"threatline.record/2","record":{"id":"CVE-2026-114101","aliases":["GHSA-3wr7-993q-jrff","GO-2026-6691"],"summary":"Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass","details":"Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.","categories":["Libraries & packages"],"product":"coraza","vendor":"corazawaf","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114101","source_modified_at":"2026-10-21T00:37:03.229Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"coraza","vendor":"corazawaf","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"3.8.1"},{"version":"3.8.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3wr7-993q-jrff","source_modified_at":"2026-10-21T10:57:00.041974308Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/corazawaf/coraza/v3","ecosystem":"Go","purl":"pkg:golang/github.com/corazawaf/coraza/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114101","source_modified_at":"2026-10-21T00:37:03.229Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"coraza","ecosystem":null},"version":"3.8.1","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3wr7-993q-jrff","source_modified_at":"2026-10-21T10:57:00.041974308Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/corazawaf/coraza/v3","ecosystem":"Go","purl":"pkg:golang/github.com/corazawaf/coraza/v3"},"version":"3.8.1"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00198,"percentile":0.09136,"score_date":"2026-10-23"},"published_at":"2026-10-21T00:37:03.229Z","modified_at":"2026-10-21T10:57:00.041974308Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114101","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T00:37:03.229Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-3wr7-993q-jrff","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T10:57:00.041974308Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114101","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/coraza-before-3.8.1-multipart-filename-charset-handling-files-rule-bypass","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T10:57:00.041974308Z","content_hash":"ccb5ba196529568d18d16ae1cf8ff71cbd352658051759d729ff21b25f4f38c9"}}