# Coraza multipart filename RFC 5987 charset bypass

Source: https://junglewise.ai/threats/coraza-multipart-filename-rfc-5987-charset-restriction-lets-a-decoy-e7805361  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-10-08

Coraza is a web application firewall that inspects file uploads to block dangerous content. An attacker can upload a file with two different filenames in the same request—declaring one in the standard field and another using an RFC 5987 extended parameter with a non-UTF-8 charset. Coraza sees only the decoy filename and allows the upload, while the backend application accepts the real filename. This bypasses file extension rules that block dangerous file types like `.php`.

Technologies: [Coraza](https://junglewise.ai/threats/technologies/coraza-coraza), [github.com/corazawaf/coraza/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-corazawaf-coraza-v3). Vendors: [Coraza](https://junglewise.ai/threats/vendors/coraza), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 8 October 2026.

**Which products and versions are affected?** Coraza before 3.8.1; github.com/corazawaf/coraza/v3 (Go) < 3.8.1.

**Is there a fix for This vulnerability?** Yes: fixed in Coraza 3.8.1. Until then: If unable to upgrade, enforce a charset allowlist via the new `MULTIPART_FILENAME_CHARSET` variable using an anchored regex rule such as `SecRule MULTIPART_FILENAME_CHARSET:upfile "!@rx ^(?:utf-8|iso-8859-1|us-ascii)$" "id:199,phase:2,t:none,t:lowercase,deny"`. Monitor for `MULTIPART_STRICT_ERROR` (rule 200003 in CRS) to catch malformed or discrepant filename declarations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Coraza or github.com/corazawaf/coraza/v3 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Coraza 3.8.1

If unable to upgrade, enforce a charset allowlist via the new `MULTIPART_FILENAME_CHARSET` variable using an anchored regex rule such as `SecRule MULTIPART_FILENAME_CHARSET:upfile "!@rx ^(?:utf-8|iso-8859-1|us-ascii)$" "id:199,phase:2,t:none,t:lowercase,deny"`. Monitor for `MULTIPART_STRICT_ERROR` (rule 200003 in CRS) to catch malformed or discrepant filename declarations.

## Technical details

Coraza's multipart body processor relies on Go's `mime.ParseMediaType` to extract filenames from `Content-Disposition` headers. The stdlib silently drops RFC 5987 `filename*` parameters when their charset is anything other than `us-ascii` or `utf-8`, leaving the plain `filename` parameter intact. An attacker can supply `filename="safe.jpg"; filename*=iso-8859-1''shell.php` to have the firewall inspect `safe.jpg` while the backend applies `shell.php`. Parts with only `filename*` (and no plain `filename`) skip file-vs-field routing entirely and are processed as form fields instead of files.

## Affected products

- Coraza Coraza before 3.8.1

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Coraza multipart filename rule bypass via RFC 5987 charset handling](https://junglewise.ai/threats/cve-2026-114101-coraza-before-3-8-1-extracts-multipart-upload-filenames-with-go)
- [Coraza request body inspection bypass in Content-Type parsing](https://junglewise.ai/threats/cve-2026-114100-coraza-from-3-0-4-before-3-8-1-contains-a-request-body)
- [Coraza JSON body processor key collision WAF bypass](https://junglewise.ai/threats/cve-2026-114099-coraza-from-3-0-0-before-3-8-1-has-a-json-body-processor-that)
- [Coraza multipart strict validation bypass via truncated body](https://junglewise.ai/threats/cve-2026-41508-coraza-truncated-multipart-body-bypasses-multipart-strict-error)
- [Coraza CRLF injection in Native audit-log format](https://junglewise.ai/threats/cve-2026-41504-coraza-native-audit-log-format-allows-crlf-injection-and-log)