Junglewise Threat Intelligence

CVE-2026-33691: OWASP Core Rule Set bypass via filename whitespace padding

CVE-2026-33691 · Severity: medium · CVSS 6.8 · Published 2026-04-02

Vendors: OWASP.

Executive brief

The OWASP Core Rule Set (CRS), a widely used security layer for web application firewalls, contains a flaw that allows attackers to bypass file upload restrictions. By adding extra spaces to a filename (such as "shell. php"), an attacker can trick the firewall into ignoring dangerous files like web shells. If the underlying web server then processes these files, it could lead to unauthorized code execution and a full compromise of the web application.

Technical details

A vulnerability in OWASP Core Rule Set (CRS) versions prior to 3.3.9 and 4.25.0 allows for the bypass of file upload security rules (specifically rules 932180, 933110, 933111, and 944140). The root cause is a failure to normalize whitespace before evaluating file extension regular expressions. An attacker can exploit this by submitting filenames with whitespace padding (e.g., "photo. php" or "shell.jsp "), which prevents the regex from matching restricted extensions like .php, .phar, or .jsp. If the backend server (particularly on Windows or certain PHP configurations) strips this whitespace during file saving, the attacker can successfully upload and execute malicious scripts. The issue is resolved by adding the 't:removeWhitespace' transformation to the affected rules.

Affected products

  • OWASP OWASP Core Rule Set (CRS) < 3.3.9, >= 4.0.0-rc1, < 4.25.0

Timeline

  • 2026-03-15: patched: Initial pull requests for fixes submitted to main branch
  • 2026-03-28: patched: Fixes backported to version 3.3 branch
  • 2026-04-02: advisory: CVE-2026-33691 disclosed and published

References