CVE-2026-44587

Name of the Vulnerable Software and Affected Versions CarrierWave versions prior to 2.2.7 CarrierWave versions prior to 3.1.3

Description CarrierWave is a framework used to upload files from Ruby applications. The content type denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the denylisted content type() function, denylist entries are interpolated directly into a regular expression without using Regexp.quote or anchoring. For example, an entry like image/svg+xml is treated as a pattern where the + character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as application/xhtml+xml, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin.

Recommendations Update to version 2.2.7 for users on the 2.x branch. Update to version 3.1.3 for users on the 3.x branch. As a temporary workaround, restrict the use of the content type denylist feature until the software is updated.