https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T03:57:46.641541+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-195179 EUVD-2026-195179 2026-10-05T03:57:46.644604+00:00 EUVD-2026-195179 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49090 fkie_cve-2023-49090 2026-10-05T03:57:46.644637+00:00

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.

 https://cve.radiocsirt.org/vuln/ghsa-gxhx-g4fq-49hj GHSA-gxhx-g4fq-49hj — CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS 2026-10-05T03:57:46.644669+00:00

Affected: RubyGems: carrierwave

### Impact [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS.

The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed.

In addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened.

### Patches Upgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).

### Workarounds When validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`.

### References [OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)

 https://cve.radiocsirt.org/vuln/gsd-2023-49090 gsd-2023-49090 2026-10-05T03:57:46.644707+00:00 gsd-2023-49090 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-49090 UBUNTU-CVE-2023-49090 2026-10-05T03:57:46.644720+00:00

Affected: Ubuntu:Pro:18.04:LTS: ruby-carrierwave, Ubuntu:Pro:20.04:LTS: ruby-carrierwave, Ubuntu:Pro:22.04:LTS: ruby-carrierwave, Ubuntu:Pro:24.04:LTS: ruby-carrierwave

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.