CVE catalog

CVE-2023-49090

CarrierWave vulnerabilities

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-carrierwavebookworm1.3.2-2vulnerable
Ubunturuby-carrierwavenobleNot reportedvulnerable
Ubunturuby-carrierwavenoble1.3.2-2ubuntu0.24.04.1~esm1fixed
Ubunturuby-carrierwavepro1.3.2-2vulnerable
Ubunturuby-carrierwavepro1.3.2-2ubuntu0.24.04.1~esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-carrierwavesourcebookworm(unfixed)not yet assignedNot reported[1068150]
Ubunturuby-carrierwavedebnoble1.3.2-2ubuntu0.24.04.1~esm1Not reportedNot reportedNot reported
Ubunturuby-carrierwavedebpro1.3.2-2ubuntu0.24.04.1~esm1Not reportedUBUNTU-CVE-2023-49090Not reported

[Debian bug #1068150]

Notes

[bookworm] ruby-carrierwave: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]