Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Coraza (github.com/corazawaf/coraza/v3) versions before 3.8.1 extract multipart upload filenames with Go's mime.ParseMediaType, which ignores RFC 5987 filename* values declared with any charset other than utf-8 or us-ascii. A remote attacker can send an upload whose real filename is hidden in such a filename* value, so FILES-based rules see a harmless name while the backend may use a dangerous one, with no authentication or user interaction needed. Upgrade to version 3.8.1 or later, which decodes filename* independently of that charset restriction.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.3 | Medium | 4.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0025, the 16th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:11 UTC First seen by agentprime
- 31 Oct 2026, 14:11 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-3wr7-993q-jrff
- OSV: GHSA-3wr7-993q-jrff
- github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff
- github.com/corazawaf/coraza/commit/5427c501b2fea6ae1305903efef01b3049224a58
- github.com/corazawaf/coraza/commit/b2a9264437116bdd98a86fe345b2aec1152d3d7c
- github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a
- github.com/corazawaf/coraza
- github.com/corazawaf/coraza/releases/tag/v3.8.1