CVE-2026-33691

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02	Patch
https://github.com/coreruleset/coreruleset/pull/4546	Issue Tracking Patch
https://github.com/coreruleset/coreruleset/pull/4547	Issue Tracking Patch
https://github.com/coreruleset/coreruleset/pull/4548	Patch
https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9	Product Release Notes
https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0	Product Release Notes
https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w	Mitigation Patch Vendor Advisory
http://seclists.org/fulldisclosure/2026/Apr/0	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/03/29/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/18/4

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set::::::::
	cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set::::::::

History

No history.

Information

Published : 2026-04-02 16:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-33691

Mitre link : CVE-2026-33691

CVE.ORG link : CVE-2026-33691

JSON object : View

Products Affected

owasp

owasp_modsecurity_core_rule_set

CWE

CWE-178

Improper Handling of Case Sensitivity

{"id": "CVE-2026-33691", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33691", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T17:38:01.007742Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coreruleset", "product": "coreruleset", "versions": [{"status": "affected", "version": "< 3.3.9"}, {"status": "affected", "version": ">= 4.0.0-rc1, < 4.25.0"}]}]}], "published": "2026-04-02T16:16:22.593", "references": [{"url": "https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/pull/4546", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/pull/4547", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/pull/4548", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/0", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/29/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/18/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-178"}]}], "descriptions": [{"lang": "en", "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0."}, {"lang": "es", "value": "El conjunto de reglas base de OWASP (CRS) es un conjunto de reglas gen\u00e9ricas de detecci\u00f3n de ataques para usar con firewalls de aplicaciones web compatibles. Antes de las versiones 3.3.9 y 4.25.0, se identific\u00f3 un bypass en OWASP CRS que permite la carga de archivos con extensiones peligrosas (.PHP, .phar, .jsp, .jspx) insertando relleno de espacios en blanco en el nombre del archivo (por ejemplo, photo. PHP o shell.jsp ). Las reglas afectadas no normalizan los espacios en blanco antes de evaluar la expresi\u00f3n regular de la extensi\u00f3n de archivo, por lo que la comprobaci\u00f3n de extensi\u00f3n de punto falla al coincidir. Este problema ha sido parcheado en las versiones 3.3.9 y 4.25.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33F8A888-1ED5-40BC-B1B9-7AA88411B0E0", "versionEndExcluding": "3.3.9"}, {"criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8822CE75-E018-4576-B30B-A25A1A2F60E0", "versionEndExcluding": "4.25.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}