CVE-2026-33691: OWASP Core Rule Set bypass via filename whitespace padding

CVE-2026-33691 · Severity: medium · CVSS 6.8 · Published 2026-04-02

The OWASP Core Rule Set (CRS), a widely used security layer for web application firewalls, contains a flaw that allows attackers to bypass file upload restrictions. By adding extra spaces to a filename (such as "shell. php"), an attacker can trick the firewall into ignoring dangerous files like web shells. If the underlying web server then processes these files, it could lead to unauthorized code execution and a full compromise of the web application.

Technologies: OWASP Core Rule Set. Vendors: OWASP.

Quick answers

Is CVE-2026-33691 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33691 being exploited in the wild.
How severe is CVE-2026-33691?
Medium severity, with a CVSS score of 6.8, published 2 April 2026.
Which products and versions are affected?
OWASP Core Rule Set < 3.3.9, >= 4.0.0-rc1, < 4.25.0.
Is there a fix for CVE-2026-33691?
A patch was published on 2026-03-15: Initial pull requests for fixes submitted to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33691 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33691?
Check whether you run OWASP Core Rule Set at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in OWASP Core Rule Set (CRS) versions prior to 3.3.9 and 4.25.0 allows for the bypass of file upload security rules (specifically rules 932180, 933110, 933111, and 944140). The root cause is a failure to normalize whitespace before evaluating file extension regular expressions. An attacker can exploit this by submitting filenames with whitespace padding (e.g., "photo. php" or "shell.jsp "), which prevents the regex from matching restricted extensions like .php, .phar, or .jsp. If the backend server (particularly on Windows or certain PHP configurations) strips this whitespace during file saving, the attacker can successfully upload and execute malicious scripts. The issue is resolved by adding the 't:removeWhitespace' transformation to the affected rules.

Affected products

  • OWASP OWASP Core Rule Set (CRS) < 3.3.9, >= 4.0.0-rc1, < 4.25.0

Timeline

  • 2026-03-15: patched: Initial pull requests for fixes submitted to main branch
  • 2026-03-28: patched: Fixes backported to version 3.3 branch
  • 2026-04-02: advisory: CVE-2026-33691 disclosed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.