The OWASP Core Rule Set does not normalize whitespace before evaluating the file‐extension regex. An attacker can therefore pad a filename with spaces (e.g., photo. php) to bypass the extension check. This permits upload of files with malicious extensions such as .php, .phar, .jsp, or .jspx. The weakness is classified as CWE‑178. The consequence of a successful bypass is that the attacker can host and run these files on the web server, leading to potential remote code execution, data compromise, and service disruption.

The vulnerability applies to the OWASP Core Rule Set in all versions earlier than 3.3.9 and 4.25.0. Any web application firewall configuration that incorporates the CRS rule set and relies on CRS for file‑upload validation is impacted. No specific vendor product names beyond the rule set itself are listed.

The CVSS base score is 6.8, indicating moderate severity. No EPSS score is provided, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker would need remote access to a file‑upload endpoint that is governed by CRS to exploit this weakness. Successful exploitation would likely lead to remote code execution or a similar compromise of the application.