The OWASP Core Rule Set failed to trim whitespace in filenames before applying the extension‑checking regular expression, creating a CWE‑178 weakness. By inserting a space before the dot, an attacker can craft a filename such as photo. php or shell.jsp that bypasses the rule set’s file‑type check. If the vulnerable WAF accepts the file and places it in an executable location, the attacker could execute arbitrary code, compromising the application and potentially the underlying server.

Deployments that use the OWASP CRS before version 3.3.9 or 4.25.0 are affected, including any web application firewall or mod_security configuration that incorporates the unpatched core rule set. This encompasses sites using the Core Rule Set with earlier releases without upgrades.

The CVSS score of 6.8 indicates medium severity, while the EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a file‑upload endpoint that accepts user‑supplied filenames; an attacker submits a file with a padded extension, and the server stores it uninspected. If the upload directory is executable, remote code execution becomes possible.