Technical details and a proof-of-concept have been published for two flaws in OWASP ModSecurity’s libmodsecurity engine: CVE-2026-104269, which lets attackers slip uploads past web application firewall rules, and CVE-2026-73857, which can crash a web server worker. Both are fixed in libmodsecurity 3.0.17, released in September.
How CVE-2026-104269 Hides Script Names From Upload Rules
The first flaw, rated CVSS 8.6, exploits a gap in how ModSecurity reads multipart uploads. A multipart upload can carry both a plain filename parameter and an RFC 2231 encoded filename parameter. ModSecurity parsed only the plain one. Core Rule Set rules 920120, 922100 and 922110 therefore evaluated a harmless-looking name, while backends decoded the filename value and saved the file under the real script name.
The advisory warns of “RCE if in webroot”: if the saved file lands in a directory the web server executes, the attacker’s script runs. A full proof-of-concept request is included in the advisory.
Backends Affected: Go, Python, Node.js and Java
The bypass works against Go, Python, Node.js and Java backends, which honor the decoded filename* value. PHP is not affected. The result is a split between what the firewall inspected and what the application stored, and that split defeats the file-extension protections the rules are meant to provide.
CVE-2026-73857 Lets One XML Request Crash a Worker
The second flaw, CVE-2026-73857, has a CVSS score of 7.5. A single crafted XML request can crash a web server worker process. Researcher Tobias Klein found it. Unlike the upload bypass, no exploit was published with it.
Disclosure Timing and Lack of In-the-Wild Attacks
libmodsecurity 3.0.17 was released on September 29, and the technical details and proof-of-concept appeared on November 9. No exploitation in the wild has been reported for either flaw. The gap of roughly six weeks between fix and detail publication gave users time to update before attack code became public, though only for those who applied the release.
Why a WAF Bypass Matters More Than Its Score Suggests
A web application firewall acts as a filter in front of applications, and organizations often rely on it to compensate for weaknesses in the backends it protects. A bypass of the upload rules means that protection can be entirely absent for upload filtering on affected backends, without any visible error. Administrators looking at a clean firewall log would see nothing unusual, because the rules evaluated what they considered a benign filename.
The flaw illustrates a recurring weakness in inspection-based defenses: any difference between how the inspector and the application parse the same input becomes an evasion route. Parser differentials of this kind have been a staple of WAF bypass research for many years, and filename encoding is one of several places where they arise.
The fix is to upgrade to ModSecurity 3.0.17. The advisory sources do not say how many deployments run vulnerable versions, nor whether any vendors that embed libmodsecurity have shipped updated packages. They also do not indicate whether the XML flaw can be triggered repeatedly to sustain a denial of service, only that one request can crash one worker.
Operational Context for the Two libmodsecurity Fixes
The three Core Rule Set rules named in the advisory, 920120, 922100 and 922110, are the checks that failed to see the real filename. Their failure shows that the weakness lies in the parser feeding them, not in the rules, which behaved as designed on the data they received.
The advisory pairs the technical description with a complete request, so defenders and attackers alike can reproduce the result. The warning “RCE if in webroot” sets the condition that turns an upload bypass into code execution: the saved script must land somewhere the server will run it.
The second flaw, found by Tobias Klein, affects availability rather than integrity. Crashing a worker with one XML request can disrupt the service for connections handled by that worker, though the sources do not describe how a server recovers.
Neither flaw is reported as exploited. The fix for both, released on September 29, is the 3.0.17 version of libmodsecurity.
