CVE-2026-33691

Name of the Vulnerable Software and Affected Versions OWASP Core Rule Set versions prior to 3.3.9 OWASP Core Rule Set versions prior to 4.25.0

Description A bypass exists in the OWASP Core Rule Set (CRS), a set of generic attack detection rules for web application firewalls. The issue allows the upload of files with dangerous extensions such as .php, .phar, .jsp, and .jspx by inserting whitespace padding into the filename. This occurs because the affected rules fail to normalize whitespace before evaluating the file extension regular expression, causing the dot-extension check to fail. This bypass is most practical on Windows systems and could potentially lead to Remote Code Execution (RCE) if the underlying application is vulnerable.

Recommendations Update to version 3.3.9. Update to version 4.25.0.