---
id: CVE-2026-114101
title: Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
summary: >-
  Coraza before 3.8.1 extracts multipart upload filenames with Go's
  mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters
  whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a
  decoy filename with …
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-20
vendor: corazawaf
product: coraza
affected:
  - coraza < 3.8.1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:03.229Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114101'
references:
  - url: >-
      https://github.com/corazawaf/coraza/security/advisories/GHSA-3wr7-993q-jrff
    label: GitHub Security Advisory (GHSA-3wr7-993q-jrff)
  - url: >-
      https://www.vulncheck.com/advisories/coraza-before-3.8.1-multipart-filename-charset-handling-files-rule-bypass
    label: >-
      VulnCheck Advisory: Coraza before 3.8.1 Multipart filename* Charset
      Handling FILES Rule Bypass
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.015Z'
---

## Overview

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.

## Affected

- `coraza < 3.8.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.