Server-side request forgery in CarrierWave
Priority LOW 22CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.
Summary
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
Why it matters now
EPSS 0.01187 68th percentileScored 2026-11-07
Fix Fixed carrierwave (carrierwaveuploader): 1.3.2, 2.1.1carrierwave (RubyGems): 1.3.2, 2.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| carrierwaveuploader | carrierwave | before 1.3.2; 2.0.0 to before 2.1.1 | 1.3.2, 2.1.1 | Patch available | CNA |
| — | carrierwave (RubyGems) | before 1.3.2 | 1.3.2 | Patch available | GHSA-fwcm-636p-68r5 |
| — | carrierwave (RubyGems) | 2.0.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-fwcm-636p-68r5 |
- carrierwave Vendorcarrierwaveuploader Affected before 1.3.2; 2.0.0 to before 2.1.1 Fixed in 1.3.2, 2.1.1 Patch available CNA
- carrierwave (RubyGems) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-fwcm-636p-68r5
- carrierwave (RubyGems) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-fwcm-636p-68r5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:carrierwave_project:carrierwave:*:*:*:*:*:ruby:*:* | before 1.3.2; 2.0.1 to before 2.1.1 | Vulnerable | carrierwaveuploader |
- cpe:2.3:a:carrierwave_project:carrierwave:*:*:*:*:*:ruby:*:* Versions before 1.3.2; 2.0.1 to before 2.1.1 Vulnerable ·carrierwaveuploader
Remediation
- Fix · CNA carrierwave (carrierwaveuploader) Fixed in 1.3.2, 2.1.1
- Fix · GHSA-fwcm-636p-68r5 carrierwave (RubyGems) Fixed in 1.3.2 Advisory →
- Fix · GHSA-fwcm-636p-68r5 carrierwave (RubyGems) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21288
- 2026-10-03 Alias added: GHSA-fwcm-636p-68r5
References
Patch 1
Advisory 5
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
- https://rubygems.org/gems/carrierwave/
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- https://nvd.nist.gov/vuln/detail/CVE-2021-21288
More carrierwaveuploader Carrierwave vulnerabilities
- TI-2026-32499 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters CVSS 3.1MEDIUM 6.1
- TI-2021-04405 Code Injection vulnerability in CarrierWave CVSS 3.1HIGH 8.8
- TI-2023-26755 CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS CVSS 3.1MEDIUM 6.8
- TI-2024-19216 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained CVSS 3.1MEDIUM 6.8
Sources
- CVE-2021-21288 · CVE Program
- CVE-2021-21288 · NVD
- FIRST EPSS
- GHSA-fwcm-636p-68r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences