CVE-2026-114101: Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-21 · updated 2026-10-28
Weakness: CWE-20

Description

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.

Affected products

Go Github.Com/Corazawaf/Coraza/V3: before 3.8.1 — fixed in 3.8.1
corazawaf coraza: before 3.8.1 — fixed in 3.8.1

How to fix

Upgrade to a fixed version: Go Github.Com/Corazawaf/Coraza/V3 3.8.1; corazawaf coraza 3.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-114101 or the next vulnerability affects your stack