CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-44587

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.

Score
4.7 medium
Published
2026-06-17
Links
NVD · cve.org

Matched ports (2)

PortPackageVersionStatusMaintainer
www/rubygem-carrierwave-gitlabrubygem-carrierwave-gitlab1.3.4unaddressedmfechner@FreeBSD.org
www/rubygem-carrierwave1rubygem-carrierwave11.3.4_1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-carrierwave-gitlab</name>
	<range><lt>2.2.7</lt></range>
      </package>
      <package>
	<name>rubygem-carrierwave1</name>
	<range><lt>2.2.7</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CarrierWave is a framework to upload files from Ruby applications. In
	versions prior to 2.2.7 and 3.1.3, the content_type_denylist check
	fails to escape regex metacharacters in string entries, causing the
	denylist to silently not match the content types it is intended to
	block. In lib/carrierwave/uploader/content_type_denylist.rb:57,
	denylist entries are interpolated directly into a regex without
	Regexp.quote or anchoring, so an entry such as image/svg+xml becomes
	the pattern /image\/svg+xml/, in which + is treated as a quantifier
	rather than a literal character and therefore never matches the real
	MIME type image/svg+xml. This is inconsistent with the allowlist
	implementation, which correctly applies both Regexp.quote and a \A
	anchor. Other content types containing regex metacharacters, such as
	application/xhtml+xml, are affected as well. As a result, any
	application that relies on content_type_denylist to block
	image/svg+xml, most commonly to prevent stored XSS, is silently
	unprotected. An attacker can upload an SVG file containing arbitrary
	JavaScript; if the application serves that SVG inline from its own
	origin, the script executes in the victim's browser, resulting in
	stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-44587</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-44587</url>
    </references>
    <dates>
      <discovery>2026-06-17</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>