CVE-2015-2963
paperclip Cross-site Scripting vulnerability
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Exploit likelihood
What each source reports
NVD Score used
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
- Record
CVE-2015-2963- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
- Record
CVE-2015-2963- Updated
- 2026-11-02
EUVDEUVD-2017-0177 No score
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
- Record
EUVD-2017-0177- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jvm-3j5h-79f6 No score
paperclip Cross-site Scripting vulnerability
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
- Record
GHSA-6jvm-3j5h-79f6- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6jvm-3j5h-79f6 No score
paperclip Cross-site Scripting vulnerability
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
- Record
GHSA-6jvm-3j5h-79f6- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
paperclipRubyGems |
before 4.2.2 | 4.2.2 |
paperclipRubyGems |
before 4.2.2, plus listed versions 2.1.02.1.22.1.52.2.02.2.1 Show 45 moreShow less2.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9.12.2.9.22.3.02.3.12.3.1.12.3.102.3.112.3.122.3.152.3.162.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.22.4.32.4.42.4.52.5.02.5.12.5.22.6.02.7.02.7.12.7.22.7.42.7.52.8.03.0.23.0.33.0.43.1.0 |
4.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2963 is a medium vulnerability (CVSS 4.3) in Thoughtbot Paperclip, published July 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in paperclip 4.2.2.
References
Left out here: 20 versions. The JSON record has them.