Coraza: Multipart Filename* (RFC 5987) Charset Restriction Lets A Decoy Filename Bypass FILES-based Rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library "mime.ParseMediaType", which only decodes the RFC 5987/6266 extended "filename" "Content-Disposition" parameter when its declared charset is exactly "us-ascii" or "utf-8". Any other charset — including...