CVE-2023-49090

Medium

Advisory

Published 29 Nov 2023In the index since 8 Sept 2026

CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 4 images.

Affected package	Affected versions	Fixed in	Images
carrierwavegem	1.3.1, 1.3.2	2.2.5	4

2 by stars

Chart

Latest

Affected images

Radar Score

openprojecthomeenterpriseinc

1 of the 1 container images this version deploys carry CVE-2023-49090.

Container image	Digest	Package	Fixed in
openproject/community :12.0.2	734743d11094	carrierwave@1.3.2	2.2.5

6,810

gitlabkubesphere

3 of the 17 container images this version deploys carry CVE-2023-49090.

Container image	Digest	Package	Fixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	carrierwave@1.3.1	2.2.5
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	carrierwave@1.3.1	2.2.5
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	carrierwave@1.3.1	2.2.5

38,133

4 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	carrierwave@1.3.1	2.2.5	1
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	carrierwave@1.3.1	2.2.5	1
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	carrierwave@1.3.1	2.2.5	1
openproject/community :12.0.2	734743d11094	carrierwave@1.3.2	2.2.5	1