Is CVE-2026-104269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104269 being exploited in the wild.

How severe is CVE-2026-104269?

High severity, with a CVSS score of 8.6, published 5 November 2026.

Which products and versions are affected?

OWASP Modsecurity 3.0.0 to 3.0.16.

Is there a fix for CVE-2026-104269?

Yes: fixed in ModSecurity 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104269 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104269?

Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104269: ModSecurity multipart parser filename precedence bypass

CVE-2026-104269 · Severity: high · CVSS 8.6 · Published 2026-11-05

ModSecurity is a web application firewall that protects web servers from malicious requests. The firewall's multipart request parser fails to follow the RFC 2231 standard for parsing filenames, allowing an attacker to send a request with one filename that ModSecurity approves but which the backend application reads as a different filename. This can bypass security checks on uploaded files, potentially allowing malicious files to be stored on the server or enabling other attacks.

Technologies: OWASP Modsecurity. Vendors: OWASP.

Quick answers

Is CVE-2026-104269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104269 being exploited in the wild.
How severe is CVE-2026-104269?: High severity, with a CVSS score of 8.6, published 5 November 2026.
Which products and versions are affected?: OWASP Modsecurity 3.0.0 to 3.0.16.
Is there a fix for CVE-2026-104269?: Yes: fixed in ModSecurity 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104269 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104269?: Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ModSecurity 3.0.17

Technical details

ModSecurity's multipart parser does not correctly implement RFC 2231 filename* parameter precedence, causing it to evaluate Content-Disposition headers differently than backend parsers (Go, Python, Node.js, Java). An attacker can craft a Content-Disposition header with a benign filename parameter and an encoded filename* parameter with a malicious value, causing the WAF to inspect one name while the backend application uses another. Rules based on MULTIPART_FILENAME and extension/content-type checks can thus be bypassed.

Affected products

OWASP ModSecurity 3.0.0 to 3.0.16

Timeline

2026-11-05: disclosed
2026-08-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.