AIKIDO-2026-153851

TL;DR

The multipart form-data parser scans for line terminators with an incorrect boolean condition that stops on a lone carriage return or newline instead of the full sequence. This truncates header values, corrupts filenames, and splits header lines at stray control characters. An attacker can craft a Content-Type header that a security filter reads differently from the actual body, bypassing upload type restrictions. The fix requires both terminator characters together before ending a scan.