Coraza WAF: Multipart upload filename parsing bypass (CVE-2026-114101)

Coraza WAF versions before 3.8.1 contain a vulnerability (CVE-2026-114101) in the multipart upload filename parsing logic. The underlying use of Go's mime.ParseMediaType function causes the parser to ignore RFC 5987 filename* parameters that utilize non-UTF-8 or non-US-ASCII character sets. An attacker can leverage this behavior by providing a decoy filename parameter while utilizing an unsupported character set encoding (e.g., iso-8859-1) to bypass security rules configured to inspect file types or names, allowing malicious files to reach the backend application.

Impact

Successful exploitation allows for the bypass of WAF file-based security rules. This enables an attacker to upload potentially malicious files that would otherwise be blocked by the WAF, increasing the risk of remote code execution or unauthorized file access on the backend application.

Recommendation

• Upgrade Coraza to version 3.8.1 or later by updating the dependency in go.mod.
• Audit existing WAF rules that rely on FILES or filename-based inspection to determine if they are susceptible to bypasses using non-standard character set encodings.
• Implement additional file validation logic on the backend application server as a secondary defense layer, independent of WAF inspection.