Server-side request forgery in thoughtbot paperclip ruby gem
Priority MEDIUM 48CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
Why it matters now
EPSS 0.03053 87th percentileScored 2026-11-07
Fix Partial paperclip (RubyGems): 5.2.0Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thoughtbot | paperclip ruby gem | All versions since 3.1.4 | — | No fix listed | CNA |
| — | paperclip (RubyGems) | 3.1.4 to before 5.2.0 | 5.2.0 | Patch available | GHSA-5jcf-c5rg-rmm8 |
- paperclip ruby gem Vendorthoughtbot Affected All versions since 3.1.4 Fixed in — No fix listed CNA
- paperclip (RubyGems) Vendor— Affected 3.1.4 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-5jcf-c5rg-rmm8
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thoughtbot:paperclip:*:*:*:*:*:ruby:*:* | 3.1.4 to before 5.2.0 | Vulnerable | thoughtbot |
- cpe:2.3:a:thoughtbot:paperclip:*:*:*:*:*:ruby:*:* Versions 3.1.4 to before 5.2.0 Vulnerable ·thoughtbot
Remediation
- Fix · GHSA-5jcf-c5rg-rmm8 paperclip (RubyGems) Fixed in 5.2.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-0889
- 2026-10-03 Alias added: GHSA-5jcf-c5rg-rmm8
References
More thoughtbot Paperclip vulnerabilities
- TI-2015-02617 The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2017-0889 · CVE Program
- CVE-2017-0889 · NVD
- FIRST EPSS
- GHSA-5jcf-c5rg-rmm8 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-0889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences