Skip to content
OpenAdvisories

Package · Debian

ruby-carrierwave

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 4.7
    CVE-2026-44587

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

    CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2023-49090

    CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissi…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • High 7.4
    CVE-2021-21305 EPSS 13%

    Code Injection vulnerability in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 4.3
    CVE-2021-21288

    Server-side request forgery in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian RubyGems