Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/paperclip@4.2.2
purl pkg:gem/paperclip@4.2.2
Next non-vulnerable version 4.3.6
Latest non-vulnerable version 5.2.0
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-7u74-jkq2-pygf
Aliases:
GMS-2015-32
It's possible to cause a DoS by uploading files with a spoofed media type, because it causes megabytes of logging to be written.
4.3.6
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-xfsg-4ypk-xfgz Content type spoofing vulnerability There is an issue where if an HTML file is uploaded with a `.html` extension, but the content type is listed as being `image/jpeg`, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named `.html` and containing actual HTML passes the spoof check. CVE-2015-2963
GHSA-6jvm-3j5h-79f6

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:36:26.005974+00:00 GitLab Importer Affected by VCID-7u74-jkq2-pygf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/paperclip/GMS-2015-32.yml 38.6.0
2026-06-02T04:36:24.546202+00:00 GitLab Importer Fixing VCID-xfsg-4ypk-xfgz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/paperclip/CVE-2015-2963.yml 38.6.0