3 known security vulnerabilities

  • moderateGHSA-7g26-2qgj-chfg(CVE-2026-44587)

    CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

Show 2 more vulnerabilities
2 moderate
  • moderateGHSA-gxhx-g4fq-49hj(CVE-2023-49090)

    CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

  • moderateGHSA-vfmv-jfc5-pjjw(CVE-2024-29034)

    CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Upload files in your Ruby applications, map them to a range of ORMs, store them on different backends.

Required Ruby Version

>= 2.5.0

Authors

Jonas Nicklas

Versions

  1. 4.0.0.rc

    1. source

      1. 4.0.0.rc source October 12, 2026 (63 KB)
  2. 4.0.0.beta

    1. source

      1. 4.0.0.beta source September 07, 2026 (58.5 KB)
  3. 3.1.4

    1. source

      1. 3.1.4 source August 30, 2026 (53.5 KB)
  4. 3.1.3

    1. source

      1. 3.1.3 source May 23, 2026 (53 KB)
  5. 3.1.2

    1. source

      1. 3.1.2 source April 13, 2025 (53 KB)
  6. 3.0.3

    1. source

      1. 3.0.3 source August 21, 2023 (51 KB)
Show all versions (92 total)

Pushed by

mshibuya

SHA 256 checksum

← Previous version Next version →