CVE-2026-33691 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0,…
Medium CVSS: 6.8

CVE-2026-33691

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
Vendor
Owasp
Product
Owasp Modsecurity Core Rule Set
CWE
CWE-178
Yayın Tarihi
2026-04-02 16:16:22
Güncelleme
2026-04-07 14:02:21
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-178 Owasp Modsecurity Core Rule Set MEDIUM Owasp 2026

Referanslar

https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02 https://github.com/coreruleset/coreruleset/pull/4546 https://github.com/coreruleset/coreruleset/pull/4547 https://github.com/coreruleset/coreruleset/pull/4548 https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9 https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0 https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w http://seclists.org/fulldisclosure/2026/Apr/0 http://www.openwall.com/lists/oss-security/2026/03/29/2