Description
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| carrierwaveuploader | carrierwave | >= 2.2.0, < 2.2.5, >= 3.0.0, < 3.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | ruby-carrierwave | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | ruby-carrierwave | 1.3.2-2ubuntu0.24.04.1~esm1 | USN-7497-1 |
| Ubuntu Pro 22.04 LTS | ruby-carrierwave | 1.3.2-2ubuntu0.22.04.1~esm1 | USN-7497-1 |
| Ubuntu Pro 20.04 LTS | ruby-carrierwave | 1.3.1-2ubuntu0.1~esm1 | USN-7497-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | ruby-carrierwave | 1.2.2-1ubuntu0.1~esm1 | USN-7497-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | carrierwave | >= 3.0.0, < 3.0.5 | 3.0.5 | GHSA-gxhx-g4fq-49hj |
| RubyGems | carrierwave | < 2.2.5 | 2.2.5 | GHSA-gxhx-g4fq-49hj |
Advisories 1
- USN-7497-1 ruby-carrierwave vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026