GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0239

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 11:22
VLAI
Title
[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability
Summary
A vulnerability was identified in OWASP CRS where whitespace padding in filenames can bypass file upload extension checks, allowing uploads of dangerous files such as .php, .phar, .jsp, and .jspx. This issue has been assigned CVE‑2026‑33691. Impact: Attackers may evade CRS protections and upload web shells disguised with whitespace‑padded extensions. Exploitation is most practical on Windows backends that normalize whitespace in filenames before execution, In linux harder because it require a backend that use like `.strip()` and `.trim()` and other whitespace trimming methods depending on the language here vulnerable to that or the webserver strip whitespaces or the backend on general, If not they not vulnerable to that. Fix: Patched in CRS v3.3.9, v4.25.x LTS, and v4.8.x. Security fixes are always backported to supported branches. References: Full advisory: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w Credits: Reported by RelunSec (aka @HackingRepo on Github). _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Owasp CRS whitespace Affected: unknown
guessed Create a notification for this product.
Credits
cyber security
Relationships
reference GCVE-1988-2026-0239 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CRS whitespace",
          "vendor": "Owasp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cyber security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in OWASP CRS where whitespace padding\nin filenames can bypass file upload extension checks, allowing uploads\nof dangerous files such as .php, .phar, .jsp, and .jspx. This issue\nhas been assigned CVE\u20112026\u201133691.\n\nImpact: Attackers may evade CRS protections and upload web shells\ndisguised with whitespace\u2011padded extensions. Exploitation is most\npractical on Windows backends that normalize whitespace in filenames\nbefore execution, In linux harder because it require a backend that\nuse like `.strip()` and `.trim()` and other whitespace trimming\nmethods depending on the language here vulnerable to that or the\nwebserver strip whitespaces or the backend on general, If not they not\nvulnerable to that.\n\nFix: Patched in CRS v3.3.9, v4.25.x LTS, and v4.8.x. Security fixes\nare always backported to supported branches.\n\nReferences:\n\nFull advisory: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w\n\nCredits: Reported by RelunSec (aka @HackingRepo on Github).\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:22:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/0"
        },
        {
          "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-33691",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0239",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/0",
            "automated": true,
            "contentSha256": "dbc5bbfddf6f7c58a38fabab60da3abc4fa5c782260725b8d161a45a6f7dd1b4",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-30T08:54:16Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:22:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0239"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.