Reject malformed base64 payload in RFC 2047 decodeWord

commons-fileupload2-core/src/main/java/org/apache/commons/fileupload2/core/MimeUtils.java

@@ -235,7 +235,9 @@ private static String decodeWord(final String word) throws ParseException, Unsup
             // get the decoded byte data and convert into a string.
             final var decodedData = out.toByteArray();
             return new String(decodedData, javaCharset(charset));
-        } catch (final IOException e) {
+        } catch (final IOException | IllegalArgumentException e) {
+            // IllegalArgumentException is thrown by the Base64 decoder on a malformed final unit; treat it like a
+            // quoted-printable decode failure so both encodings reject malformed input the same way.
             throw new UnsupportedEncodingException("Invalid RFC 2047 encoding");
         }
     }

commons-fileupload2-core/src/test/java/org/apache/commons/fileupload2/core/MimeUtilityTestCase.java

@@ -32,6 +32,13 @@ private static void assertEncoded(final String expected, final String encoded) t
         assertEquals(expected, MimeUtils.decodeText(encoded));
     }
 
+    @Test
+    void testDecodeInvalidBase64() {
+        // A base64 payload whose final unit is truncated ("A" is a single base64 char) is rejected the same way as a
+        // malformed quoted-printable payload, rather than leaking an IllegalArgumentException from the base64 decoder.
+        assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?UTF-8?B?A?="));
+    }
+
     @Test
     void testDecodeInvalidEncoding() {
         assertThrows(UnsupportedEncodingException.class, () -> MimeUtils.decodeText("=?invalid?B?xyz-?="));