{"id":"CVE-2023-49090","aliases":["DEBIAN-CVE-2023-49090","EUVD-2023-2969","GHSA-gxhx-g4fq-49hj","UBUNTU-CVE-2023-49090","USN-7497-1"],"status":"published","title":"CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00613,"percentile":0.4972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-11-29T14:38:52Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"RubyGems","package":"carrierwave","fixed_in":["3.0.5","2.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-carrierwave","fixed_in":["1.2.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-carrierwave","fixed_in":["1.3.1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-carrierwave","fixed_in":["1.3.2-2ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ruby-carrierwave","fixed_in":["1.3.2-2ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-2","2.0.2-1","2.2.2-1","3.0.7-1"]},{"source":"osv","ecosystem":"RubyGems","package":"carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.5"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4"]},{"source":"osv","ecosystem":"RubyGems","package":"carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5"}]}],"versions":["0.1","0.10.0","0.11.0","0.11.1","0.11.2","0.2.0","0.2.1","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.5.1","0.3.5.2","0.4.0","0.4.1","0.4.10","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.0.beta2","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.9.0","1.0.0","1.0.0.beta","1.0.0.rc","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","2.0.0","2.0.0.rc","2.0.1","2.0.2","2.1.0","2.1.1","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1ubuntu0.1~esm1"}]}],"versions":["0.10.0+gh-4","1.1.0-3","1.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-2ubuntu0.1~esm1"}]}],"versions":["1.3.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2ubuntu0.22.04.1~esm1"}]}],"versions":["1.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2ubuntu0.24.04.1~esm1"}]}],"versions":["1.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1ubuntu0.1~esm1"}]}],"versions":["0.10.0+gh-4","1.1.0-3","1.2.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-2ubuntu0.1~esm1"}]}],"versions":["1.3.1-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2ubuntu0.22.04.1~esm1"}]}],"versions":["1.3.2-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ruby-carrierwave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-2ubuntu0.24.04.1~esm1"}]}],"versions":["1.3.2-2"],"bundled":2}],"products":[{"vendor":"carrierwave_project","product":"carrierwave"},{"vendor":"carrierwaveuploader","product":"carrierwave"}],"references":[{"url":"https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49090","tags":["advisory"]},{"url":"https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb","tags":["web"]},{"url":"https://rubygems.org/gems/carrierwave/versions/2.2.5","tags":["web"]},{"url":"https://rubygems.org/gems/carrierwave/versions/3.0.5","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2023-49090.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gxhx-g4fq-49hj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49090.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49090","tags":["advisory"]},{"url":"https://github.com/carrierwaveuploader/carrierwave","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-49090","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49090","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7497-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21305","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-49090","title":"CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T14:38:52.195Z","modified":"2024-10-11T17:55:40.314Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-2969","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T14:38:52Z","modified":"2024-10-11T17:55:40Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:39.149807Z"}],"ghsa":[{"id":"GHSA-gxhx-g4fq-49hj","title":"CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS","description":"### Impact\n[CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. \n\nThe validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match.\nIf the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed.\n\nIn addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened.\n\n### Patches\nUpgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).\n\n### Workarounds\nWhen validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`.\n\n### References\n[OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)\n","status":"published","published":"2023-11-29T21:33:27Z","modified":"2023-11-30T21:44:18Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-49090","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T15:15:08.9Z","modified":"2026-06-17T06:35:20.703Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-49090","title":"CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T14:38:52.195Z","modified":"2026-10-28T02:30:42.455420561Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-49090","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T15:15:08.9Z","modified":"2026-10-26T18:03:07.541930562Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-gxhx-g4fq-49hj","title":"CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS","description":"### Impact\n[CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. \n\nThe validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match.\nIf the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed.\n\nIn addition, by setting the Content-Type configured by the attacker at the time of file delivery, it is possible to cause XSS on the user's browser when the uploaded file is opened.\n\n### Patches\nUpgrade to [3.0.5](https://rubygems.org/gems/carrierwave/versions/3.0.5) or [2.2.5](https://rubygems.org/gems/carrierwave/versions/2.2.5).\n\n### Workarounds\nWhen validating with `allowlisted_content_type?` in [CarrierWave::Uploader::ContentTypeAllowlist](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb) , forward match(`\\A`) the Content-Type set in `content_type_allowlist`, preventing unintentional permission of `text/html;image/png` when you want to allow only `image/png` in `content_type_allowlist`.\n\n### References\n[OWASP - File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html#content-type-validation)\n","status":"published","published":"2023-11-29T21:33:27Z","modified":"2023-11-29T21:33:27Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"UBUNTU-CVE-2023-49090","description":"CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.","status":"published","published":"2023-11-29T15:15:00Z","modified":"2026-02-04T04:19:39.50044Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"USN-7497-1","title":"ruby-carrierwave vulnerabilities","description":"Rikita Ishikawa discovered that CarrierWave did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2021-21305)\n\nNorihide Saito discovered that CarrierWave did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. (CVE-2023-49090)\n","status":"published","published":"2025-05-07T01:25:52Z","modified":"2026-04-27T17:58:21.383866Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}