Comment by lxxvii

Note that Cloudflare rules are case-sensitive. I'm not sure whether PHP's parsing of "multipart" is or not, but you might consider:

  any(lower(http.request.headers["content-type"][*])[*] contains "multipart")

Also, unless your server is specifically set up to only accept requests from Cloudflare, someone could likely send a request directly to your IP, so you might consider blocking multipart requests at the server level. For Nginx I added the following to all /server blocks:

  if ($http_content_type ~* "multipart") { return 403; }

Luckily our service doesn't use multipart for any critical requests.