CVE-2026-44587

🗓️ 16 Jun 2026 23:10:43Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 72 Views

CVE-2026-44587 CarrierWave denylisted content type bypass due to unescaped regex metacharacters; fixed in 2.2.7 and 3.1.3.

Reporter	Title	Published	Views	Family All 93
Circl	CVE-2026-44587	23 May 202605:40	–	circl
Cvelist	CVE-2026-44587 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters	16 Jun 202623:10	–	cvelist
Debian CVE	CVE-2026-44587	16 Jun 202623:10	–	debiancve
EUVD	EUVD-2026-37515	16 Jun 202623:10	–	euvd
Github Security Blog	CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters	27 May 202600:03	–	github
Mend	CVE-2026-44587	16 Jun 202623:10	–	mend
NVD	CVE-2026-44587	17 Jun 202613:20	–	nvd
osv_cga	CGA-2529-V3G2-7332	24 Aug 202623:56	–	osv_cga
osv_cga	CGA-2FRV-8J74-CPGP	10 Sep 202619:25	–	osv_cga
osv_cga	CGA-2QPF-7H44-HJH6	27 May 202612:59	–	osv_cga

NVD

Vulners

Node

carrierwave_project carrierwaveRange<2.2.7ruby

carrierwave_project carrierwaveRange3.0.0–3.1.3ruby

[
  {
    "vendor": "carrierwaveuploader",
    "product": "carrierwave",
    "versions": [
      {
        "version": "< 2.2.7",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0.rc, < 3.1.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
github	www.github.com/carrierwaveuploader/carrierwave/commit/21221cc6e260633f7da78c6133a88666a5529d27
github	www.github.com/carrierwaveuploader/carrierwave/commit/4c4a005775a436c5165df014dc9b1874c227d86c

18 Jun 2026 15:24Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.7 - 6.1

EPSS0.00338

SSVC

CarrierWave content type denylist regex metacharacters stored XSS version 2.2.7 version 3.1.3