Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6jfa-g6gq-x3h2
Vulnerability ID VCID-6jfa-g6gq-x3h2
Aliases CVE-2026-44587
GHSA-7g26-2qgj-chfg
Summary CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-116 Improper Encoding or Escaping of Output
System Score Found at
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44587
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44587
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44587
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7g26-2qgj-chfg
cvssv3.1 4.7 https://github.com/carrierwaveuploader/carrierwave
generic_textual MODERATE https://github.com/carrierwaveuploader/carrierwave
cvssv3.1 4.7 https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
cvssv3.1_qr MODERATE https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
generic_textual MODERATE https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
cvssv3.1 4.7 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2026-44587.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2026-44587.yml
cvssv3 4.7 https://www.cve.org/CVERecord?id=CVE-2026-44587
cvssv3.1 4.7 https://www.cve.org/CVERecord?id=CVE-2026-44587
generic_textual MODERATE https://www.cve.org/CVERecord?id=CVE-2026-44587
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-44587
https://github.com/carrierwaveuploader/carrierwave
https://www.cve.org/CVERecord?id=CVE-2026-44587
CVE-2026-44587.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2026-44587.yml
GHSA-7g26-2qgj-chfg https://github.com/advisories/GHSA-7g26-2qgj-chfg
GHSA-7g26-2qgj-chfg https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/carrierwaveuploader/carrierwave
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2026-44587.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Found at https://www.cve.org/CVERecord?id=CVE-2026-44587
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09636
EPSS Score 0.00031
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:38:51.047729+00:00 GHSA Importer Import https://github.com/advisories/GHSA-7g26-2qgj-chfg 38.6.0