Skip to content
OpenAdvisories

Weakness (CWE)

CWE-436: Interpretation Conflict

Class Incomplete

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Source: MITRE CWE-436

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.0
    CVE-2026-114101 Public exploit

    Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass

    Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go