TI-2026-32499 CVE-2026-44587 · GHSA-7g26-2qgj-chfg
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
Priority MEDIUM 60
CarrierWave is a framework to upload files from Ruby applications.
carrierwaveuploader
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
carrierwaveuploader records in CISA KEVNo carrierwaveuploader vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Carrierwave · all components
TI-2021-04405 CVE-2021-21305 · GHSA-cf3w-g86h-35x4
Code Injection vulnerability in CarrierWave
Priority MEDIUM 53
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications.
TI-2023-26755 CVE-2023-49090 · GHSA-gxhx-g4fq-49hj
CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS
Priority LOW 31
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks.
TI-2024-19216 CVE-2024-29034 · GHSA-vfmv-jfc5-pjjw
CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
Priority LOW 30
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks.
TI-2021-04388 CVE-2021-21288 · GHSA-fwcm-636p-68r5
Server-side request forgery in CarrierWave
Priority LOW 22
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications.