CVE-2026-33691

Imagine your security system is a bouncer who checks a guest’s ID by looking at the file extension (like “.jpg” or “.pdf”). This bug lets someone put extra spaces inside the filename so the bouncer looks at the wrong part and mistakenly lets a harmful file type through. If the web server can then treat that uploaded file as executable code, attackers may be able to take over the site.

This matters if you run a web application firewall that uses the OWASP ModSecurity Core Rule Set (coreruleset) for detecting and blocking risky file uploads. The bypass does not require the attacker to be logged in, and it involves uploading files with a filename crafted to include whitespace around dangerous extensions. It becomes a risk when an attacker can reach your application’s file upload feature and your CRS version is prior to 3.3.9 (or 4.25.0), and the upload-checking logic is covered by the affected rules.

This is an AMBER issue because attackers can bypass upload extension checks over the network without needing an account. While there’s no clear public report of real-world exploitation in the findings, the fix is straightforward and addresses a direct path to uploading malicious files. Update the CRS rules to the fixed versions as soon as possible and verify upload blocking after the change.