CVE-2026-114101 corazawaf CVE debrief

Who should care

Defenders responsible for Coraza deployments, particularly those using version 3.8.0 or earlier, should assess exposure and prioritize updates. They should also review and adjust file upload handling in backend applications, monitor for suspicious file upload activity, and verify their Coraza version.

Why it matters

Coraza's handling of multipart file uploads with extended filename parameters can be bypassed, allowing an attacker to present a different filename to the backend application. Defenders should prioritize verifying their Coraza version and updating to 3.8.1 or later if necessary.

• attackers can present a decoy filename to Coraza and a different one to the backend application
• FILE-based rules can be bypassed
• file-vs-field routing decisions can be manipulated

Technical summary

Coraza extracts a multipart file upload's filename using Go's standard-library `mime.ParseMediaType`, which has limited charset support for RFC 5987/6266 extended `filename*` `Content-Disposition` parameters. This can lead to attackers bypassing FILES-based rules and manipulating file-vs-field routing decisions by presenting different filenames to Coraza and the backend application. The issue arises from the library's handling of charsets other than `us-ascii` or `utf-8`, which are silently dropped without error or fallback.

Defensive priority

Defenders should prioritize verifying their Coraza version and updating to 3.8.1 or later if necessary.

Recommended defensive actions

• Verify Coraza version and update to 3.8.1 or later if necessary
• Review and adjust file upload handling in backend applications
• Monitor for suspicious file upload activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue arises from Coraza's use of Go's standard-library `mime.ParseMediaType`, which only decodes the RFC 5987/6266 extended `filename*` `Content-Disposition` parameter for specific charsets. This limited charset support can lead to attackers presenting decoy filenames to Coraza and different ones to the backend application. The problem is further complicated by the fact that `mime.ParseMediaType` silently drops charsets other than `us-ascii` or `utf-8`, with no error or fallback signal.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.