CVE-2025-29914
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.
Reserved 2025-03-12 | Published 2025-03-20 | Updated 2025-03-20 | Assigner GitHub_MCWE-706: Use of Incorrectly-Resolved Name or Reference
github.com/...coraza/security/advisories/GHSA-q9f5-625g-xm39
github.com/...ommit/4722c9ad0d502abd56b8d6733c6b47eb4111742d
Support options
