4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44587

CVE-2026-44587: CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44587

CVE-2026-44587:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
carrierwave	rubygems	>= 3.0.0.beta, < 3.1.3	3.1.3
carrierwave	rubygems	< 2.2.7	2.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the CarrierWave gem because it fails to properly sanitize user-provided content type strings before using them in a regular expression for its denylist (or blacklist) feature. Specifically, the denylisted_content_type? and blacklisted_content_type? functions directly interpolate strings from the denylist into a regex. This allows an attacker to use a content type with a regex metacharacter, such as image/svg+xml, where the + is interpreted as a quantifier ('one or more of the preceding character') rather than a literal plus sign. As a result, the regex fails to match the intended content type, and the denylist is bypassed, potentially leading to Cross-Site Scripting (XSS) if a malicious SVG file is uploaded.

The patch addresses this by applying Regexp.quote to the denylist items before they are used in the regex, ensuring that any special characters are treated as literals. The analysis of the patch commits 21221cc and 4c4a005 confirms these changes in lib/carrierwave/uploader/content_type_denylist.rb and lib/carrierwave/uploader/content_type_blacklist.rb, respectively. The functions check_content_type_denylist! and check_content_type_blacklist! are the entry points that trigger these vulnerable checks and would appear in a runtime profile during exploitation.

Vulnerable functions

CarrierWave::Uploader::ContentTypeDenylist.denylisted_content_type?

lib/carrierwave/uploader/content_type_denylist.rb

The function `denylisted_content_type?` is vulnerable because it directly interpolates the `item` from the denylist into a regular expression without escaping metacharacters. This allows an attacker to use characters with special meaning in regex, like `+`, to craft a content type that bypasses the denylist. The patch fixes this by adding `Regexp.quote(item)` to escape any special characters.

CarrierWave::Uploader::ContentTypeBlacklist.blacklisted_content_type?

lib/carrierwave/uploader/content_type_blacklist.rb

Similar to `denylisted_content_type?`, this function in older versions of CarrierWave (using the `blacklist` terminology) is also vulnerable. It fails to escape regex metacharacters from the `content_type_denylist` array, allowing a crafted content type to bypass the check. The patch applies `Regexp.quote` to fix the vulnerability.

CarrierWave::Uploader::ContentTypeDenylist.check_content_type_denylist!

lib/carrierwave/uploader/content_type_denylist.rb

This function acts as a wrapper and calls the vulnerable `denylisted_content_type?` function. During exploitation, this function would be present in the stack trace as it's responsible for initiating the content type check against the denylist.

CarrierWave::Uploader::ContentTypeBlacklist.check_content_type_blacklist!

lib/carrierwave/uploader/content_type_blacklist.rb

This function acts as a wrapper and calls the vulnerable `blacklisted_content_type?` function in older versions. During exploitation, this function would be present in the stack trace as it's responsible for initiating the content type check against the blacklist.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.