Skip to content
OpenAdvisories

Package · Ubuntu

ruby-carrierwave

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.7
    CVE-2026-44587

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

    CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2023-49090

    CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissi…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • High 7.4
    CVE-2021-21305 EPSS 13%

    Code Injection vulnerability in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems