CVE-2026-33691
Owasp Modsecurity Core Rule Set ≤ 3.3.9
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:NSummary
CVE-2026-33691 is a medium-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Owasp Owasp Modsecurity Core Rule Set. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked in the top 12% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33691 is a vulnerability in the OWASP Core Rule Set (CRS), a collection of generic attack detection rules designed for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, the affected rules fail to normalize whitespace in filenames before evaluating file extension regular expressions, enabling a bypass that allows uploading files with dangerous extensions such as .php, .phar, .jsp, and .jspx. Attackers can exploit this by inserting whitespace padding around the dot in the extension, for example "photo. php" or "shell.jsp", causing the dot-extension check to fail matching.
Remote attackers with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Successful exploitation changes the scope and results in high integrity impact by bypassing file upload restrictions in web application firewalls using the vulnerable CRS, potentially allowing attackers to upload malicious files that could lead to server-side code execution if processed by the underlying web application.
Mitigation is available through upgrading to OWASP CRS versions 3.3.9 or 4.25.0, where the issue has been patched. Relevant GitHub references include the fixing commit at https://github.com/coreruleset/coreruleset/commit/2a8c63512811c5dd74472becebb79a783e68ff02 and pull requests #4546, #4547, and #4548, along with the v3.3.9 release at https://github.com/coreruleset/coreruleset/releases/tag/v3.3.9. The vulnerability is rated 6.8 on the CVSS 3.1 scale (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) and maps to CWE-178 (Improper Handling of Case Sensitivity).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18352
Vulnerability Data
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous…
more
extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Applying access control decisions to each request depends on accurate property determination that accounts for case differences.
Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC practices should include case-sensitivity requirements in design and coding standards.
Application security requirements must specify case handling for identifiers and paths.
Architecture principles should enforce canonical, case-aware resource naming.
Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.
Access-control rules that ignore case can allow unintended resource access.
Authentication logic must treat identifiers consistently to avoid bypass via case differences.