{"cve":"CVE-2021-21288","nvd":{"published":"2021-02-08T20:15:12.277","modified":"2026-06-17T03:35:12.133","status":"Modified","description":"CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-918"],"references":["https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08","https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08","https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0","https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5","https://rubygems.org/gems/carrierwave/"],"products":["carrierwave_project:carrierwave"],"source":"nvd","synced_at":"2026-10-19T21:14:10.479542811+00:00"},"epss":{"cve":"CVE-2021-21288","score":0.01173,"percentile":0.67476,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fwcm-636p-68r5","url":"https://osv.dev/vulnerability/GHSA-fwcm-636p-68r5","summary":"Server-side request forgery in CarrierWave","modified":"2026-09-10T03:49:14.221682448Z","packages":[{"ecosystem":"RubyGems","name":"carrierwave","purl":"pkg:gem/carrierwave","ranges":["<1.3.2"],"fixed":["1.3.2"]},{"ecosystem":"RubyGems","name":"carrierwave","purl":"pkg:gem/carrierwave","ranges":[">=2.0.0 <2.1.1"],"fixed":["2.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}