CVE-2026-114101

Coraza versions prior to 3.8.1 are vulnerable to a FILES rule bypass due to improper handling of multipart upload filenames. The issue stems from the use of Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters if the charset is not utf-8 or us-ascii . This allows unauthe...