CVE-2026-44587: Permissive Regular Expression

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the contenttypedenylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In...

CVE-2026-44587

creationtimestamp| type| source ---|---|--- 2026-05-23 05:40:33+00:00| published-proof-of-concept| https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg 2026-06-17 03:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohfhrsnfp2j...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the allowlistedcontenttype? function. An attacker can bypass the Content-Type allowlist, potentially leading to the exploitation of this vulnerability by passing a crafted value as the contenttype argument...