PT-2026-43454 · Carrierwave+5 · Carrierwave+1
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
CarrierWave versions prior to 2.2.7
CarrierWave versions prior to 3.1.3
Description
CarrierWave is a framework used to upload files from Ruby applications. The
content type denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the denylisted content type() function, denylist entries are interpolated directly into a regular expression without using Regexp.quote or anchoring. For example, an entry like image/svg+xml is treated as a pattern where the + character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as application/xhtml+xml, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin.Recommendations
Update to version 2.2.7 for users on the 2.x branch.
Update to version 3.1.3 for users on the 3.x branch.
As a temporary workaround, restrict the use of the
content type denylist feature until the software is updated.Exploit
Fix
XSS
Incomplete List of Disallowed Inputs
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Carrierwave
Ruby-Carrierwave