PT-2026-28792 · Unknown · Kusanagi-Mod Security Crs

Hackingrepo · Published 2026-01-01 · Updated 2026-04-19 · CVE-2026-33691

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OWASP Core Rule Set (CRS) versions prior to 3.3.9 and prior to 4.25.0

Description The OWASP Core Rule Set (CRS) contains a flaw where whitespace padding in filenames can bypass file upload extension checks. This allows the upload of dangerous files such as .php, .phar, .jsp, and .jspx. The affected rules do not normalize whitespace before evaluating the file extension regex, leading to a failure in the dot-extension check. Exploitation is most practical on Windows systems.

Recommendations Upgrade to OWASP CRS version 3.3.9 or 4.25.0.

Fix

RCE

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2026-33691

Affected Products

Kusanagi-Mod Security Crs

References · 24

• https://github.com/coreruleset/coreruleset/pull/4547 · Patch
• https://github.com/coreruleset/coreruleset/pull/4546 · Patch
• https://github.com/coreruleset/coreruleset/pull/4548 · Patch
• https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33691 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33691 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33691 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33691 · Security Note
• https://ubuntu.com/security/CVE-2026-33691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33691 · Security Note
• https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w · Patch, Vendor Advisory
• https://github.com/coreruleset/coreruleset/releases/tag/v4.25.0 · Note
• https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9 · Note
• https://twitter.com/CoreRuleSet/status/2038725851747905752 · Twitter Post
• https://twitter.com/kusanagi_saya/status/2038541754757210371 · Twitter Post