Coraza Web Application Firewall versions before 3.8.1 extract multipart upload filenames using Go’s mime.ParseMediaType. The parser silently ignores RFC 5987 filename* parameters when the specified charset is not UTF‑8 or US‑ASCII. An unauthenticated attacker can therefore supply a decoy filename such as filename*=iso-8859-1''shell.php or use only the filename* attribute, causing Coraza’s FILES‑based rules never to see the real file name. As a result, the file is passed unchanged to downstream components that honor the filename* value, allowing potentially dangerous uploads to reach the target system.

The vulnerability affects Coraza Web Application Firewall deployments running any version earlier than 3.8.1. No sub‑product or specific patch level is mentioned beyond this version requirement.

The CVSS score is 6.3, indicating medium severity, while the EPSS score is below 1 %, reflecting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely through an unauthenticated HTTP file upload, causing the backend to receive the uploaded file under the name supplied in the filename* parameter, which is ignored by Coraza’s sanitization.