ModSecurity's multipart parser from versions 3.0.0 through 3.0.17 does not honor the RFC 2231 filename* precedence when parsing the Content‑Disposition header. An attacker can include a benign filename parameter that the WAF inspects while supplying a different, encoded filename* value that the backend routing libraries prefer. This mismatch allows the WAF's MULTIPART_FILENAME rules to evaluate a safe name while the application saves or processes a malicious file name, enabling dangerous file uploads or content‑type spoofing. The vulnerability can lead to accidental or intentional storage of files with harmful extensions or MIME types that bypass WAF checks. Based on the description, it is inferred that the attack demands only the ability to send HTTP requests to the protected application, a typical attacker capability on publicly exposed services.

The affected product is the open‑source ModSecurity web‑application‑firewall engine. Versions 3.0.0 up to and including 3.0.17 of ModSecurity are impacted. The issue was mitigated in the 3.0.17 release. No other ModSecurity major version is explicitly listed as affected by this flaw.

The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, so no current exploitation probability is known, but the flaw is listed as not being part of the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the issue via a crafted HTTP request that includes a Content‑Disposition header with a benign filename parameter and a distinct filename* value. Since this vulnerability resides in the gateway layer, it is reachable from the public network and can be weaponized against any backend that relies on RFC2231 compliant parsing, typical of Go, Python, Node.js, and Java implementations.