Looks like the writeup from the ModSecurity folks is here: https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/ https://coreruleset.org/2021

Looks like the writeup from the ModSecurity folks is here: https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/ https://coreruleset.org/20210630/cve-2021-35368-crs-request-... perhaps it's better to change the URL? The explanation is a little hard for me to follow, but it sounds to me like it works like if you have a php file /foo/bar.php, you can always run that as /foo/bar.php/biz/baz (this is a standard php/apache feature). The bypass is if you make requests to /foo/bar.php/admin/content/assets/add/blah then there is no request body inspection. IMO, calling this a "severe vulnerability in ModSecurity" though is a little silly. WAFs always have false negatives by design. My first interpretation was that it would be an RCE on the apache daemon or something.