What’s Vulnerable › Products

carrierwaveuploader carrierwave vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your carrierwaveuploader carrierwave version is affected

Latest carrierwaveuploader carrierwave vulnerabilities

• CVE-2026-44587 — CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters (CVSS 6.1)
• CVE-2024-29034 — CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained (CVSS 6.1)
• CVE-2023-49090 — CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS (CVSS 6.1)
• CVE-2021-21305 — Code Injection vulnerability in CarrierWave (CVSS 8.8)
• CVE-2021-21288 — Server-side request forgery in CarrierWave (CVSS 4.3)