Skip to content
OpenAdvisories

Package · Ubuntu

ruby-carrierwave

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-44587

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

    CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2023-49090

    CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissi…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems