OWASP CRS
Loading the README
- v4.30.02026-10-02fix: inspect REQUEST_FILENAME in RCE (932) rules to close path-based command injection bypass —
- v4.25.22026-10-02v4.25.2 (LTS)
- v4.29.02026-08-17fix(932): add backslash-prefix evasion to shell command detection
- v3.3.102026-07-02Requires libmodsecurity v3.0.16 or later when running on nginx/libmodsecurity v3. The XML attribute injection fix (ctl:…
- v4.25.12026-07-02v4.25.1 (LTS)
✓ signed The latest release, v4.30.0, carries a signature GitHub verified.
Loading the security report