# CVE-2026-104269: ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- owasp-modsecurity / ModSecurity: >= 3.0.0, < 3.0.17 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 8.6 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-436

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-104269; retrieved 2026-11-05; source updated 2026-11-05

Revision: 4892a365c7b9f17cae7e7fbbd1c338a52169d23a4aee2882de02a98b1a90fab9

Canonical: https://y2.dev/cve/CVE-2026-104269

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.