CVE-2026-44587: CarrierWave Content Type Denylist Bypass Vulnerability
Summary
CVE-2026-44587: CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters. Affects carrierwave across 2 version ranges.
< 2.2.7
>= 3.0.0.beta, < 3.1.3
Fixed in 2.2.7 or 3.1.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CarrierWave is a Ruby gem that provides a simple and flexible way to upload files in Ruby applications. It allows developers to manage file uploads easily, offering features like file storage, processing, and validation. However, a vulnerability exists in its content type denylist feature, which is intended to block specific file types from being uploaded. This vulnerability arises from the improper handling of regex metacharacters in denylist entries, which can lead to unintended file uploads.
Vulnerability Detail
The vulnerability in CarrierWave stems from the content_type_denylist check failing to escape regex metacharacters in string entries. This oversight allows certain content types, such as 'image/svg+xml', to bypass the denylist, potentially enabling attackers to upload malicious files. The issue is not with CarrierWave itself but with how developers implement the denylist. The regex interpolation does not correctly match the intended MIME types, leaving applications vulnerable to attacks like stored XSS.
How To Fix
Latest published version: 3.1.4 as of 23 Oct 2026
gem install carrierwave -v 3.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.72.2.7gem install carrierwave -v 2.2.7 -
>= 3.0.0.beta, < 3.1.33.1.3gem install carrierwave -v 3.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to manually validate the content types of uploaded files before processing them. This can be done by checking the content type against a predefined list of allowed types in your application logic.
Conclusion
The CarrierWave vulnerability CVE-2026-44587 highlights a critical issue with the content type denylist feature, which can lead to serious security risks if not addressed. Developers are urged to update their CarrierWave versions and implement the recommended code changes to ensure their applications remain secure.
See every vulnerability recorded for carrierwave →
FAQ
The vulnerability allows certain file types to bypass the content type denylist due to improper regex handling, potentially leading to security issues like stored XSS.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, attackers can upload malicious files, which may lead to data breaches, unauthorized access, or execution of harmful scripts.
Yes, the vulnerability has been patched in CarrierWave versions 3.1.3 and 2.2.7. It is recommended to update to these versions or later.
Implement a manual validation of uploaded file types as a temporary measure until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for carrierwave.
