ModSecurity Vulnerability CVE-2026-104269: File Uploads Can Slip Past WAF Rules, Three Flaws Rated High, and the Fixed Versions to Install

If your website or web app sits behind ModSecurity, the open-source web application firewall (WAF), it needs an update: the project published eight security advisories on September 30, 2026, and three are rated High. The most important one lets a malicious file upload slip past the firewall's filename rules, which means attacks you think are being filtered can still reach your application.

The fixes are in ModSecurity 3.0.17 and 2.9.15, both dated September 29 on the project's release pages. Here is what the project confirms, what it does not, and what to do this week.

ModSecurity vulnerability: what is confirmed

This comes from the project's own security advisories and release notes:

• Eight advisories carry a September 30, 2026 publication date: three High, four Moderate and one Low. None of the eight is rated Critical.
• The 3.0.17 release notes list fixes for all eight. The 2.9.15 release notes list six of them.
• The three High advisories do not mention attacks in the wild.

The other five cover rule evasion and host verification for remote rules download. Two stand out. CVE-2026-61812 means the HTML decoding step misses named entities, and the advisory says about 35 OWASP CRS rules are affected. CVE-2026-104259 lets SQL injection and cross-site scripting payloads hidden with inline comments get past rules.

How the ModSecurity WAF bypass works

CVE-2026-104269: the file upload bypass

A file upload can carry two names: filename and the newer filename*. ModSecurity's parser does not implement the newer form, and OWASP CRS filename rules read the raw header. Many application frameworks prefer filename*. So an attacker can show the firewall safe.jpg while the application receives shell.php, which is the advisory's own example.

The advisory lists Go, Python Flask and FastAPI, Node.js (busboy and @fastify/multipart) and Java Spring as affected. PHP's native upload handling is listed as not affected, because it reads only filename=.

CVE-2026-73856: the response inspection bypass

ModSecurity's check of the response content type is case sensitive. If a backend returns Text/Html instead of text/html, the response is not inspected, so rules meant to stop data leaks do not run. The advisory says SQL errors, stack traces and debug information can get out. It applies when response body inspection is on and such rules exist. The advisory does not explain how an attacker would make a real backend send a mixed-case header. Its demo backend simply reflected a query parameter into the header.

CVE-2026-73857: the XML request crash

One crafted request, with no login, can make a ModSecurity worker use an uninitialized pointer. It is only reachable when SecParseXmlIntoArgs is On or OnlyArgs, and the default is Off.

What is claimed and what is not known

• Critical? If you see these called critical, that is not the project's rating. The highest rating in this batch is High.
• Remote code execution? Not demonstrated as a general result. The upload advisory describes code execution only if the application stores the file under the attacker's name and the web server runs it from a web root. The XML advisory says impact ranges from denial of service to memory disclosure, "possibly leading to remote code execution."
• Being exploited? Not known. The High advisories do not say either way.
• How many sites are exposed? Not known. We found no figure from the project.
• Is the upload flaw patched? The advisory's patched field still says none, and its affected range names only 3.0.0 and later. The release notes for both 3.0.17 and 2.9.15 list a fix under the same advisory ID, and Debian marks its Apache v2 packages as vulnerable. Treat both branches as affected and both releases as the fix.
• Is v2 hit by the XML flaw? The advisory says v2 is not affected, although 2.9.15 adds a guard under the same advisory ID.

ModSecurity on Apache, Nginx and IIS: which version you need

The project's README describes v3 as a library, with the Nginx connector supplied by the separate ModSecurity-nginx project. It describes v2 as ModSecurity for Apache. The 2.9.13 notes removed Nginx support from v2, and the 2.9.15 notes include an IIS-specific fix. Check which branch you actually run, then move to the latest release on that branch.

What to do this week: ModSecurity patch checklist

1. Find every ModSecurity install. On Apache, run apachectl -M | grep -i security. On Nginx, run nginx -V 2>&1 | grep -i modsecurity. For the version, use dpkg -l | grep -i modsec or rpm -qa | grep -i mod_sec. If a hosting panel or appliance bundles it, ask that vendor directly.
2. Update. Version 3 goes to 3.0.17. Version 2 goes to 2.9.15.
3. Check your Linux package separately. On November 9, 2026, Debian's tracker showed CVE-2026-104269 as vulnerable in every listed release, with no fixed package. An upstream release does not mean your package has the fix.
4. Confirm the XML setting. Make sure SecParseXmlIntoArgs is Off, which is the advisory's workaround. grep -ri SecParseXmlIntoArgs /etc/ will find it in most setups.
5. Lock down uploads in the application. Validate names and types in the code, store uploads outside the web root, and make sure upload folders cannot run code.
6. Turn off verbose errors in production. Stack traces and SQL errors should not depend on a firewall rule to stay private.
7. Retest after updating. Both releases add MULTIPART_DUPLICATE_PART_HEADER, MULTIPART_FILENAME_CHARSET and MULTIPART_FILENAME_LANGUAGE, which custom rules can use. Watch for legitimate traffic being blocked.

Why a WAF bypass matters for a business

Companies often put a WAF in front of applications they cannot change quickly, such as vendor software or an older custom app. In that setup the WAF is doing the job of the missing fix. A bypass does not break in by itself, but it removes the layer that was supposed to catch the attack, so any upload form or injection flaw behind it is exposed again.

If you run your own servers and infrastructure, this patch is yours to schedule. If a host or developer manages them, ask which ModSecurity version is running and when it will be updated.

ModSecurity vulnerability questions people are asking

Which ModSecurity version fixes these flaws?

ModSecurity 3.0.17 for version 3 and 2.9.15 for version 2.

Is there a ModSecurity RCE?

Code execution is described as conditional or possible, not as a confirmed general result. It depends on your configuration and how your application stores uploads.

Is ModSecurity being actively exploited?

The High advisories do not mention attacks in the wild, and nothing we opened confirms any. That is not proof that none are happening.

Does the ModSecurity upload bypass affect PHP sites?

The advisory lists PHP's native upload handling as not affected by CVE-2026-104269. The other advisories concern the WAF engine itself, so PHP sites still need the update.

Is OWASP CRS affected?

The flaws are in the ModSecurity engine, but CRS rules depend on it. The advisories name CRS filename rules 920120, 922100 and 922110, and about 35 CRS rules for the HTML decoding flaw.

Is there a workaround if I cannot patch ModSecurity?

Only the XML flaw has one: keep SecParseXmlIntoArgs set to Off. For the upload flaw, the advisory lists none, so application-side upload controls are the practical stopgap.

The bigger lesson

A WAF is software, and it has bugs like everything it protects. Treat it as one layer, keep it on your patch list, and make sure the application behind it can defend itself when that layer has a gap.

Want your web servers and firewall rules checked? See security hardening or get a quote.

Get security alerts by email, with the free checklist, at security alerts.

Sources: ModSecurity security advisories; ModSecurity 3.0.17 release notes; ModSecurity 2.9.15 release notes; GHSA-5pww-8rfg-9crf; GHSA-vmg8-j66p-vgvw; GHSA-jx3r-phvx-2jmj; Debian security tracker.