Coraza multipart filename RFC 5987 charset bypass

Severity: medium · CVSS 4 · Published 2026-10-08

Coraza is a web application firewall that inspects file uploads to block dangerous content. An attacker can upload a file with two different filenames in the same request—declaring one in the standard field and another using an RFC 5987 extended parameter with a non-UTF-8 charset. Coraza sees only the decoy filename and allows the upload, while the backend application accepts the real filename. This bypasses file extension rules that block dangerous file types like `.php`.

Technologies: Coraza, github.com/corazawaf/coraza/v3 (Go). Vendors: Coraza, Go.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4, published 8 October 2026.
Which products and versions are affected?
Coraza before 3.8.1; github.com/corazawaf/coraza/v3 (Go) < 3.8.1.
Is there a fix for This vulnerability?
Yes: fixed in Coraza 3.8.1. Until then: If unable to upgrade, enforce a charset allowlist via the new `MULTIPART_FILENAME_CHARSET` variable using an anchored regex rule such as `SecRule MULTIPART_FILENAME_CHARSET:upfile "!@rx ^(?:utf-8|iso-8859-1|us-ascii)$" "id:199,phase:2,t:none,t:lowercase,deny"`. Monitor for `MULTIPART_STRICT_ERROR` (rule 200003 in CRS) to catch malformed or discrepant filename declarations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Coraza or github.com/corazawaf/coraza/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Coraza 3.8.1

If unable to upgrade, enforce a charset allowlist via the new `MULTIPART_FILENAME_CHARSET` variable using an anchored regex rule such as `SecRule MULTIPART_FILENAME_CHARSET:upfile "!@rx ^(?:utf-8|iso-8859-1|us-ascii)$" "id:199,phase:2,t:none,t:lowercase,deny"`. Monitor for `MULTIPART_STRICT_ERROR` (rule 200003 in CRS) to catch malformed or discrepant filename declarations.

Technical details

Coraza's multipart body processor relies on Go's `mime.ParseMediaType` to extract filenames from `Content-Disposition` headers. The stdlib silently drops RFC 5987 `filename*` parameters when their charset is anything other than `us-ascii` or `utf-8`, leaving the plain `filename` parameter intact. An attacker can supply `filename="safe.jpg"; filename*=iso-8859-1''shell.php` to have the firewall inspect `safe.jpg` while the backend applies `shell.php`. Parts with only `filename*` (and no plain `filename`) skip file-vs-field routing entirely and are processed as form fields instead of files.

Affected products

  • Coraza Coraza before 3.8.1

Timeline

  • 2026-10-08: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.