PatchTheCVECVE-2026-33691: The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web applicati
CVE-2026-33691 is a medium-severity flaw (CVSS 6.8) affecting owasp modsecurity core rule set. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the filename (e.g. photo. php or shell.jsp ). The affected rules do not normalize whitespace before evaluating the file extension regex,
Why this priority
- EPSS top 10%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 3.8% (top 10%) |
| CISA exploited list | No |
| Weakness | CWE-178 |
| Published | 2026-04-02 |
| Last modified | 2026-07-24 |
Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33691?
owasp modsecurity core rule set: upgrade to 3.3.9, 4.25.0. Exact commands for each OS are on this page.
Is CVE-2026-33691 being exploited?
CVE-2026-33691 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33691 affect?
CVE-2026-33691 affects owasp modsecurity core rule set. Severity is medium (CVSS 6.8). The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous
How urgent is CVE-2026-33691?
Priority 51/100. EPSS top 10%: very likely to be exploited; Remotely exploitable, no login, no user action