Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CRS whitespace",
          "vendor": "Owasp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cyber security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in OWASP CRS where whitespace padding\nin filenames can bypass file upload extension checks, allowing uploads\nof dangerous files such as .php, .phar, .jsp, and .jspx. This issue\nhas been assigned CVE\u20112026\u201133691.\n\nImpact: Attackers may evade CRS protections and upload web shells\ndisguised with whitespace\u2011padded extensions. Exploitation is most\npractical on Windows backends that normalize whitespace in filenames\nbefore execution, In linux harder because it require a backend that\nuse like `.strip()` and `.trim()` and other whitespace trimming\nmethods depending on the language here vulnerable to that or the\nwebserver strip whitespaces or the backend on general, If not they not\nvulnerable to that.\n\nFix: Patched in CRS v3.3.9, v4.25.x LTS, and v4.8.x. Security fixes\nare always backported to supported branches.\n\nReferences:\n\nFull advisory: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w\n\nCredits: Reported by RelunSec (aka @HackingRepo on Github).\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:22:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/0"
        },
        {
          "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-33691",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0239",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/0",
            "automated": true,
            "contentSha256": "dbc5bbfddf6f7c58a38fabab60da3abc4fa5c782260725b8d161a45a6f7dd1b4",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-30T08:54:16Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:22:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0239"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}