Skip to content
OpenAdvisories

Vendor

carrierwaveuploader

5 known vulnerabilities.

carrierwaveuploader at a glance

Last 12 months
1
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

carrierwave 5
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 4.7
    CVE-2026-44587

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

    CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2024-29034

    CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is po…

    carrierwaveuploader carrierwave carrierwave RubyGems
  • Medium 6.8
    CVE-2023-49090

    CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissi…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • High 7.4
    CVE-2021-21305 EPSS 13%

    Code Injection vulnerability in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 4.3
    CVE-2021-21288

    Server-side request forgery in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian RubyGems