5 known security vulnerabilities

  • highGHSA-cf3w-g86h-35x4(CVE-2021-21305)

    Code Injection vulnerability in CarrierWave::RMagick

Show 4 more vulnerabilities
4 moderate
  • moderateGHSA-7g26-2qgj-chfg(CVE-2026-44587)

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

  • moderateGHSA-fwcm-636p-68r5(CVE-2021-21288)

    Server-side request forgery in CarrierWave

  • moderateGHSA-gxhx-g4fq-49hj(CVE-2023-49090)

    CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

  • moderateGHSA-vfmv-jfc5-pjjw(CVE-2024-29034)

    CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Upload files in your Ruby applications, map them to a range of ORMs, store them on different backends.

Required Ruby Version

>= 2.0.0

Authors

Jonas Nicklas

Versions

  1. 4.0.0.rc

    1. source

      1. 4.0.0.rc source October 12, 2026 (63 KB)
  2. 4.0.0.beta

    1. source

      1. 4.0.0.beta source September 07, 2026 (58.5 KB)
  3. 3.1.4

    1. source

      1. 3.1.4 source August 30, 2026 (53.5 KB)
  4. 3.1.3

    1. source

      1. 3.1.3 source May 23, 2026 (53 KB)
  5. 3.1.2

    1. source

      1. 3.1.2 source April 13, 2025 (53 KB)
  6. 1.3.1

    1. source

      1. 1.3.1 source December 29, 2018 (45 KB)
Show all versions (92 total)

SHA 256 checksum

← Previous version Next version →