# CVE-2026-104269: ModSecurity multipart parser filename precedence bypass

Source: https://junglewise.ai/threats/cve-2026-104269-modsecurity-is-an-open-source-cross-platform-web-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-104269 · Severity: high · CVSS 8.6 · Published 2026-11-05

ModSecurity is a web application firewall that protects web servers from malicious requests. The firewall's multipart request parser fails to follow the RFC 2231 standard for parsing filenames, allowing an attacker to send a request with one filename that ModSecurity approves but which the backend application reads as a different filename. This can bypass security checks on uploaded files, potentially allowing malicious files to be stored on the server or enabling other attacks.

Technologies: [OWASP Modsecurity](https://junglewise.ai/threats/technologies/modsecurity). Vendors: [OWASP](https://junglewise.ai/threats/vendors/owasp).

## Quick answers

**Is CVE-2026-104269 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104269 being exploited in the wild.

**How severe is CVE-2026-104269?** High severity, with a CVSS score of 8.6, published 5 November 2026.

**Which products and versions are affected?** OWASP Modsecurity 3.0.0 to 3.0.16.

**Is there a fix for CVE-2026-104269?** Yes: fixed in ModSecurity 3.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104269 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104269?** Check whether you run OWASP Modsecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ModSecurity 3.0.17

## Technical details

ModSecurity's multipart parser does not correctly implement RFC 2231 filename* parameter precedence, causing it to evaluate Content-Disposition headers differently than backend parsers (Go, Python, Node.js, Java). An attacker can craft a Content-Disposition header with a benign filename parameter and an encoded filename* parameter with a malicious value, causing the WAF to inspect one name while the backend application uses another. Rules based on MULTIPART_FILENAME and extension/content-type checks can thus be bypassed.

## Affected products

- OWASP ModSecurity 3.0.0 to 3.0.16

## Timeline

- 2026-11-05: disclosed
- 2026-08-08: patched

## References

- [https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0](https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0)
- [https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d](https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d)

## Related threats

- [ModSecurity uninitialized pointer dereference in XML parsing](https://junglewise.ai/threats/cve-2026-73857-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity htmlEntityDecode rule bypass via incomplete entity handling](https://junglewise.ai/threats/cve-2026-61812-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity removeComments bypass via adjacent comments](https://junglewise.ai/threats/cve-2026-104259-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity response body inspection bypass with mixed-case Content-Type](https://junglewise.ai/threats/cve-2026-73856-modsecurity-is-an-open-source-cross-platform-web-application)
- [ModSecurity @rxGlobal match-limit bypass](https://junglewise.ai/threats/cve-2026-103932-modsecurity-is-an-open-source-cross-platform-web-application)