SB2026110642 - Multiple vulnerabilities in CarrierWave

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110642

SB2026110642 - Multiple vulnerabilities in CarrierWave

Published: November 6, 2026

Security Bulletin ID SB2026110642
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect Regular Expression (CVE-ID: CVE-2026-44587)

CWE-ID: CWE-185 - Incorrect Regular Expression

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to bypass configured content type restrictions and upload files that an application intends to block.

The vulnerability exists due to unescaped regular expression metacharacters in CarrierWave's content_type_denylist string entries when applications configure MIME types such as image/svg+xml. An unauthenticated remote attacker can submit an SVG containing a script that passes the denylist check and is stored despite the explicit restriction.


Remediation

Install update from vendor's website.

References