This rule fires on any legitimate multipart file upload to /api/files/local, not just command-injection attempts.
Root cause
In the pcre, the skip class [^\x26]*? only stops at &, so it walks past the closing " of the filename="…" field and matches the \x0a of the line’s terminating \r\n (which is in the detection alternation). Any filename without a literal & therefore matches.
Reproduce
POST a normal multipart upload to /api/files/local with e.g. filename="model.gcode" and any body - the rule alerts despite no metacharacter in the filename.
Suggested fix
bound the search to the filename value and add & as a detected metachar:
pcre:"/^[^\x22\x0d\x0a]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24)|(?:\x26|%26))+/R"
[^\x26] --> [^\x22\x0d\x0a] stops at the closing quote / CR / LF so the terminator can’t match; injected metacharacters (including a raw \x0a inside the value) still trip.
