{"action":"Upgrade carrierwave to 2.2.7 or later.","affected":[{"fixed":"3.1.3","introduced":"3.0.0.beta"},{"fixed":"2.2.7","introduced":"0"}],"component":"carrierwave","cve_ids":["CVE-2026-44587"],"ecosystem":"RubyGems","epss":0.00223,"exploited":false,"fixed_versions":["3.1.3","2.2.7"],"ghsa_id":"GHSA-7g26-2qgj-chfg","id":"tcs_01M5KEHQ5WXQF5GCRQFF7SZ54Q","modified_at":"2026-07-08T17:45:15.058151776Z","published_at":"2026-05-27T00:03:11Z","references":["https://osv.dev/vulnerability/GHSA-7g26-2qgj-chfg","https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg","https://nvd.nist.gov/vuln/detail/CVE-2026-44587","https://github.com/carrierwaveuploader/carrierwave/commit/21221cc6e260633f7da78c6133a88666a5529d27","https://github.com/carrierwaveuploader/carrierwave/commit/4c4a005775a436c5165df014dc9b1874c227d86c","https://github.com/carrierwaveuploader/carrierwave","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2026-44587.yml","https://www.cve.org/CVERecord?id=CVE-2026-44587"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-7g26-2qgj-chfg","url":"https://osv.dev/vulnerability/GHSA-7g26-2qgj-chfg"}],"summary":"CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters"}