Incorrect Regular Expression in CarrierWave - CVE-2026-44587
Published: November 6, 2026
Vulnerability identifier: #VU159570
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44587
CWE-ID: CWE-185
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to bypass configured content type restrictions and upload files that an application intends to block.
The vulnerability exists due to unescaped regular expression metacharacters in CarrierWave's content_type_denylist string entries when applications configure MIME types such as image/svg+xml. An unauthenticated remote attacker can submit an SVG containing a script that passes the denylist check and is stored despite the explicit restriction.
Affected software
CarrierWave
How to mitigate CVE-2026-44587
Install security update from vendor's website.
CarrierWave - addressed in versions 2.2.7, 3.1.3