Loading story…
OWASP disclosed CVE-2026-33691, a vulnerability in the Core Rule Set (CRS) that lets attackers evade file upload extension checks by appending whitespace to filenames. The bypass can allow dangerous server-executable files such as .php, .phar, .jsp, and .jspx to be uploaded, creating a path to web shell deployment if the backend later normalizes or trims the filename before execution.
The issue is considered most impactful on Windows backends, where trailing whitespace in filenames may be normalized automatically, while Linux systems are generally harder to exploit unless the application or web server explicitly trims names with functions such as strip() or trim(). OWASP patched the flaw in CRS 3.3.9, 4.25.x LTS, and 4.8.x, with fixes backported to supported branches; the vulnerability was reported by RelunSec (also known as @HackingRepo on GitHub).
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
A Rapid7 Metasploit pull request introduced an option to bypass OWASP CRS protections for CVE-2026-33691 using whitespace-padded filenames. The development was tracked in Metasploit's workflow and attributed to smcintyre-r7.
A public advisory disclosed technical details of the OWASP CRS whitespace padding bypass, including that Linux exploitation is less straightforward unless backend applications or web servers trim filenames before execution.
OWASP CRS fixed the vulnerability in versions 3.3.9, 4.25.x LTS, and 4.8.x, and backported the security fix to supported branches.
The whitespace padding file upload bypass in OWASP CRS was assigned CVE-2026-33691. The flaw can allow dangerous files such as .php, .phar, .jsp, and .jspx to pass extension checks, with higher risk on Windows backends that normalize or trim whitespace.
RelunSec, also known as @HackingRepo on GitHub, reported a vulnerability in OWASP Core Rule Set that allows file upload extension checks to be bypassed by padding filenames with whitespace.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceseclists.org
Open sourcenews.ycombinator.com
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026
Apache Struts developers released fixes for **CVE-2024-53677**, a critical vulnerability in the framework's file upload handling that can allow malicious file upload and **remote code execution** in applications using `FileUploadInterceptor`. The flaw affects Struts versions `2.0.0` through `2.3.37`, `2.5.0` through `2.5.33`, and `6.0.0` through `6.3.0.2`, and has been assigned a **CVSS 4.0 score of 9.5**. Public proof-of-concept exploit code is available, and CSIRT.SK reported that the vulnerability is being actively exploited in the wild. Apache's guidance points organizations to **Struts 6.4.0 or later**, but the vendor's file upload documentation indicates remediation is not limited to patching alone: affected applications must also update source code to adopt the framework's newer file upload mechanism. Defenders are advised to review network and security logs for signs of compromise, as exposed internet-facing Struts applications that still rely on the legacy upload interceptor face elevated risk of exploitation.
Jul 24, 2026
Pentagrid reported that testing of Ergon's **Airlock Web Application Firewall** against portions of the **OWASP Core Rule Set (CRS)** regression suite found numerous payloads that Airlock allowed while CRS would normally block, spanning scanner detection, protocol enforcement, file inclusion, remote code execution, PHP injection, generic application attacks, SQL injection, and Java-related attack strings. The researchers also identified a PHP short-tag payload that bypassed both Airlock and CRS; after disclosure, CRS closed that detection gap, while Airlock still allowed the payload in the tested mid-2024 configuration and Ergon opened internal tickets to review the findings. A second bypass highlighted a broader weakness in XML parsing: XSS payloads hidden in **XML attribute values** were not inspected by several CRS rules because they checked `XML:/*` text nodes but not `XML://@*` attributes. That gap aligns with **CVE-2022-3442**, a reflected XSS flaw Pentagrid disclosed in **CREALOGIX**'s `ebics.aspx` endpoint, where attacker-controlled input in the EBICS Version field could be reflected into an HTML error response. CRS maintainers later fixed the XML-attribute false negative in `v4.28.0` under **GHSA-6jp8-c2w2-x7wr** by extending coverage to XML attributes and adding regression tests, while CREALOGIX had already released patches and advised customers to update to version `7.1` or apply vendor fixes.
Jul 29, 2026