---
title: "CVE-2026-44587\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-44587?format=md
keywords: index, follow
---

# CVE-2026-44587

Publication date 17 June 2026

Last updated 25 June 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**4.7 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-44587?format=md#impact-score)

Toggle side navigation

## Description

CarrierWave is a framework to upload files from Ruby applications. In
versions prior to 2.2.7 and 3.1.3, the content\_type\_denylist check fails to
escape regex metacharacters in string entries, causing the denylist to
silently not match the content types it is intended to block. In
lib/carrierwave/uploader/content\_type\_denylist.rb:57, denylist entries are
interpolated directly into a regex without Regexp.quote or anchoring, so an
entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which
+ is treated as a quantifier rather than a literal character and therefore
never matches the real MIME type image/svg+xml. This is inconsistent with
the allowlist implementation, which correctly applies both Regexp.quote and
a \A anchor. Other content types containing regex metacharacters, such as
application/xhtml+xml, are affected as well. As a result, any application
that relies on content\_type\_denylist to block image/svg+xml, most commonly
to prevent stored XSS, is silently unprotected. An attacker can upload an
SVG file containing arbitrary JavaScript; if the application serves that
SVG inline from its own origin, the script executes in the victim's
browser, resulting in stored XSS. This issue has been fixed in versions
2.2.7 and 3.1.3.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| ruby-carrierwave | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

4.7 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | Required |
  | Scope | Changed |
  | Confidentiality impact | Low |
  | Integrity impact | None |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 4.7 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44587)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-44587)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-44587)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-44587)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-44587>