CVE-2026-44587

🗓️ 16 Jun 2026 23:10:43Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 55 Views

CVE-2026-44587 CarrierWave denylisted content type bypass due to unescaped regex metacharacters; fixed in 2.2.7 and 3.1.3.

Reporter	Title	Published	Views	Family All 67
Circl	CVE-2026-44587	23 May 202605:40	–	circl
Cvelist	CVE-2026-44587 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters	16 Jun 202623:10	–	cvelist
Debian CVE	CVE-2026-44587	16 Jun 202623:10	–	debiancve
EUVD	EUVD-2026-37515	16 Jun 202623:10	–	euvd
Github Security Blog	CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters	27 May 202600:03	–	github
NVD	CVE-2026-44587	17 Jun 202613:20	–	nvd
OSV	CGA-2529-V3G2-7332	24 Aug 202623:56	–	osv
OSV	CGA-2QPF-7H44-HJH6	27 May 202612:59	–	osv
OSV	CGA-3433-P3PG-85WF	23 Jul 202600:08	–	osv
OSV	CGA-345P-FF8R-P93V	27 May 202611:22	–	osv

NVD

Node

carrierwave_project carrierwaveRange<2.2.7ruby

carrierwave_project carrierwaveRange3.0.0–3.1.3ruby

[
  {
    "vendor": "carrierwaveuploader",
    "product": "carrierwave",
    "versions": [
      {
        "version": "< 2.2.7",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0.rc, < 3.1.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/carrierwaveuploader/carrierwave/commit/4c4a005775a436c5165df014dc9b1874c227d86c
github	www.github.com/carrierwaveuploader/carrierwave/commit/21221cc6e260633f7da78c6133a88666a5529d27
github	www.github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg

18 Jun 2026 15:24Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.7 - 6.1

EPSS0.00223

SSVC

CarrierWave content type denylist regex metacharacters stored XSS version 2.2.7 version 3.1.3