CVE-2026-33691

HIGH EPSS 59.2%
Published Apr 2, 20262mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Apr 2, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
59.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-178

Affected Products 2

VendorProductVersionRange
owaspowasp_modsecurity_core_rule_set* <3.3.9
owaspowasp_modsecurity_core_rule_set*≥4.0.0  –  <4.25.0

References 10

  • seclists.org http://seclists.org/fulldisclosure/2026/Apr/0
    Mailing ListThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2026/03/29/2
    Mailing ListThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/18/4
  • github.com https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02
    Patch
  • github.com https://github.com/coreruleset/coreruleset/pull/4546
    Issue TrackingPatch
  • github.com https://github.com/coreruleset/coreruleset/pull/4547
    Issue TrackingPatch
  • github.com https://github.com/coreruleset/coreruleset/pull/4548
    Patch
  • github.com https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9
    ProductRelease Notes
  • github.com https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0
    ProductRelease Notes
  • github.com https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02
    Patch
  • github.com https://github.com/coreruleset/coreruleset/pull/4546
    Issue TrackingPatch
  • github.com https://github.com/coreruleset/coreruleset/pull/4547
    Issue TrackingPatch
  • github.com https://github.com/coreruleset/coreruleset/pull/4548
    Patch
  • github.com https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w
    MitigationPatchVendor Advisory