5 known security vulnerabilities

  • highGHSA-cf3w-g86h-35x4(CVE-2021-21305)

    Code Injection vulnerability in CarrierWave::RMagick

Show 4 more vulnerabilities
4 moderate
  • moderateGHSA-7g26-2qgj-chfg(CVE-2026-44587)

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

  • moderateGHSA-fwcm-636p-68r5(CVE-2021-21288)

    Server-side request forgery in CarrierWave

  • moderateGHSA-gxhx-g4fq-49hj(CVE-2023-49090)

    CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

  • moderateGHSA-vfmv-jfc5-pjjw(CVE-2024-29034)

    CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

* RDoc Documentation {available at Rubyforge}[http://carrierwave.rubyforge.org/]. * Source code {hosted at GitHub}[http://github.com/jnicklas/carrierwave] * Please {report any issues}[http://github.com/jnicklas/carrierwave/issues] on GitHub * Please direct any questions at the {mailing list}[http://groups.google.com/group/carrierwave]

Required Ruby Version

None

Authors

Jonas Nicklas

Versions

  1. 4.0.0.rc

    1. source

      1. 4.0.0.rc source October 12, 2026 (63 KB)
  2. 4.0.0.beta

    1. source

      1. 4.0.0.beta source September 07, 2026 (58.5 KB)
  3. 3.1.4

    1. source

      1. 3.1.4 source August 30, 2026 (53.5 KB)
  4. 3.1.3

    1. source

      1. 3.1.3 source May 23, 2026 (53 KB)
  5. 3.1.2

    1. source

      1. 3.1.2 source April 13, 2025 (53 KB)
  6. 0.3.4

    1. source

      1. 0.3.4 source September 24, 2009 (47.5 KB)
Show all versions (92 total)

SHA 256 checksum

← Previous version Next version →