CVE-2026-33691

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33691
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33691.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33691
Aliases
  • GHSA-rw5f-9w43-gv2w
Downstream
Published
2026-04-02T15:03:52.126Z
Modified
2026-07-27T03:56:33.638052032Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks
Details

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33691.json",
    "cwe_ids": [
        "CWE-178"
    ]
}
References

Affected packages

Git / github.com/coreruleset/coreruleset

Affected ranges

Type
GIT
Repo
https://github.com/coreruleset/coreruleset
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29240641f78ddb535313eec2a322a89e6520b7e5
Introduced
1d95422bb31983a5290720b7fb662ce3dd51f753
Fixed
aabf675fcfc5e489b424b844e6c9f1b39802df69
Fixed
2a8c63512811c5dd74472becebb79a783e68ff02
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.9"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.25.0"
        }
    ],
    "cpe": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
nightly
v2.*
v2.2.5
v2.2.6
v2.2.7
v3.*
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.0.1
v3.1.0-rc1
v3.2-rc1
v3.2.0-rc1
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.1-rc1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v4.*
v4.0.0
v4.1.0
v4.10.0
v4.11.0
v4.12.0
v4.13.0
v4.14.0
v4.15.0
v4.16.0
v4.17.0
v4.17.1
v4.18.0
v4.19.0
v4.2.0
v4.20.0
v4.21.0
v4.22.0
v4.23.0
v4.24.0
v4.24.1
v4.3.0
v4.4.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33691.json"