CVE-2026-33691

Name	CVE-2026-33691
Description	The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex, so the dot-extension check fails to match. This issue has been patched in versions 3.3.9 and 4.25.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
modsecurity-crs (PTS)	bullseye	3.3.0-1+deb11u1	vulnerable
	bullseye (security)	3.3.4-1~deb11u2	vulnerable
	bookworm	3.3.4-1	vulnerable
	bookworm (security)	3.3.4-1+deb12u1	vulnerable
	trixie (security), trixie	3.3.7-1+deb13u1	vulnerable
	forky, sid	3.3.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
modsecurity-crs	source	(unstable)	3.3.9-1

Notes

[trixie] - modsecurity-crs <no-dsa> (Minor issue)
[bookworm] - modsecurity-crs <no-dsa> (Minor issue)
[bullseye] - modsecurity-crs <postponed> (Minor issue)
https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w