By vendor

Carrierwave_project vulnerabilities

Known CVEs affecting Carrierwave_project products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-44587MEDIUM 4.7

  CarrierWave, a popular Ruby file-upload framework, contains a flaw in its content-type blocking mechanism that silently fails to prevent dangerous uploads. When developers configure a denylist to block file types—most commonly SVG files to prevent stored cross-site scripting (XSS)—the framework inadvertently allows those exact files through due to improper handling of special characters in the filter rules. An attacker can exploit this to upload malicious SVG files containing embedded JavaScript that executes in users' browsers when served by the application, resulting in account compromise or data theft.