CVE-2026-114101: Coraza multipart filename rule bypass via RFC 5987 charset handling

CVE-2026-114101 · Severity: medium · CVSS 4 · Published 2026-10-21

Coraza is a Web Application Firewall (WAF) that uses rules to inspect file uploads and block dangerous content. The vulnerability allows attackers to bypass filename-based upload rules by submitting a decoy filename alongside the real filename in a different character encoding, causing the WAF to inspect the wrong name while the backend application uses the real one. This can allow dangerous files like shell.php to reach the backend without triggering security blocks.

Technologies: Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go), github.com/corazawaf/coraza/v3 (Go). Vendors: Coraza, Go.

Quick answers

Is CVE-2026-114101 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114101 being exploited in the wild.
How severe is CVE-2026-114101?
Medium severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?
Coraza before 3.8.1; github.com/corazawaf/coraza (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v2 (Go) SEMVER:introduced=0; github.com/corazawaf/coraza/v3 (Go) SEMVER:introduced=0,fixed=3.8.1.
Is there a fix for CVE-2026-114101?
Yes. github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later. Until then: Until upgraded, implement backend-level filename validation that does not blindly trust the plain filename parameter and instead follows RFC 7578 precedence to check both filename and filename* values in security decisions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114101 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114101?
Check whether you run Coraza, github.com/corazawaf/coraza (Go), github.com/corazawaf/coraza/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/corazawaf/coraza/v3 (Go): upgrade to 3.8.1 or later
    go get github.com/corazawaf/coraza/v3@v3.8.1

Until upgraded, implement backend-level filename validation that does not blindly trust the plain filename parameter and instead follows RFC 7578 precedence to check both filename and filename* values in security decisions.

Technical details

Coraza uses Go's mime.ParseMediaType to extract filenames from multipart upload Content-Disposition headers. The stdlib function only decodes RFC 5987 filename* parameters when their charset is exactly us-ascii or utf-8; any other charset (such as iso-8859-1, which RFC 5987 explicitly permits) is silently discarded, leaving the decoy plain filename parameter to be used instead. An unauthenticated attacker can send both filename and filename* with different values and different charsets, bypassing FILES-based extension blocklist rules while a standards-compliant backend honors the filename* precedence and uses the real filename.

Affected products

  • Coraza Coraza before 3.8.1

Identifiers

  • CVE-2026-114101
  • GHSA-3wr7-993q-jrff
  • GO-2026-6691

Timeline

  • 2026-10-02: disclosed
  • 2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.