VulnerableCode Package Details - pkg:gem/paperclip@4.2.1

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:gem/paperclip@4.2.1

Essentials
History (4)

purl	pkg:gem/paperclip@4.2.1

Next non-vulnerable version	5.2.0
Latest non-vulnerable version	5.2.0
Risk	4.5

Vulnerabilities affecting this package (3)

Vulnerability	Summary	Fixed by
VCID-b6da-ujn4-7ya4 Aliases: CVE-2017-0889 GHSA-5jcf-c5rg-rmm8	Paperclip suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the `Paperclip::UriAdapter` class. Attackers may be able to access information about internal network resources.	5.2.0 Affected by 0 other vulnerabilities.
VCID-xfsg-4ypk-xfgz Aliases: CVE-2015-2963 GHSA-6jvm-3j5h-79f6	Content type spoofing vulnerability There is an issue where if an HTML file is uploaded with a `.html` extension, but the content type is listed as being `image/jpeg`, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named `.html` and containing actual HTML passes the spoof check.	4.2.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ypnr-rewr-ckhx Aliases: GHSA-phmw-pv3f-vvx7	Moderate severity vulnerability that affects paperclip Withdrawn, accidental duplicate publish. The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.	4.2.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-05T16:17:55.151621+00:00	GHSA Importer	Affected by	VCID-ypnr-rewr-ckhx	https://github.com/advisories/GHSA-phmw-pv3f-vvx7	38.6.0
2026-06-04T20:10:10.189800+00:00	GitLab Importer	Affected by	VCID-b6da-ujn4-7ya4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/paperclip/CVE-2017-0889.yml	38.6.0
2026-06-04T20:04:56.942571+00:00	GitLab Importer	Affected by	VCID-xfsg-4ypk-xfgz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/paperclip/CVE-2015-2963.yml	38.6.0
2026-06-04T18:09:39.540633+00:00	Ruby Importer	Affected by	VCID-xfsg-4ypk-xfgz	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paperclip/CVE-2015-2963.yml	38.6.0