diff --git a/.travis.yml b/.travis.yml
index aac63ed36..663f10326 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -84,7 +84,7 @@ jobs:
       script:
         - yarn test --colors
         - bundle exec rails db:create db:schema:load assets:precompile
-        - bundle exec bundle-audit check --update --ignore CVE-2015-9284 CVE-2021-21288 CVE-2021-21305
+        - bundle exec bundle-audit check --update --ignore CVE-2015-9284
         - bin/test-console-check
         - yarn build-storybook
         - bundle exec rake data_updates:run # required for at least creating the first admin user in e2e tests.
diff --git a/Gemfile.lock b/Gemfile.lock
index a8c8d8dc5..d40221bf0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -164,13 +164,14 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    carrierwave (2.1.0)
+    carrierwave (2.1.1)
       activemodel (>= 5.0.0)
       activesupport (>= 5.0.0)
       addressable (~> 2.6)
       image_processing (~> 1.1)
       mimemagic (>= 0.3.0)
       mini_mime (>= 0.1.3)
+      ssrf_filter (~> 1.0)
     carrierwave-bombshelter (0.2.2)
       activesupport (>= 3.2.0)
       carrierwave
@@ -387,7 +388,7 @@ GEM
     httpclient (2.8.3)
     hypershield (0.2.2)
       activerecord (>= 5)
-    i18n (1.8.8)
+    i18n (1.8.9)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     image_processing (1.12.1)
@@ -744,6 +745,7 @@ GEM
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
+    ssrf_filter (1.0.7)
     staccato (0.5.3)
     stackprof (0.2.16)
     store_attribute (0.8.1)
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index 842b1646e..a9373b2a6 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -101,6 +101,12 @@ RSpec.configure do |config|
   config.before do
     # Worker jobs shouldn't linger around between tests
     Sidekiq::Worker.clear_all
+    # Disable SSRF protection for CarrierWave specs
+    # See: https://github.com/carrierwaveuploader/carrierwave/issues/2531
+    # rubocop:disable Rspec/AnyInstance
+    allow_any_instance_of(CarrierWave::Downloader::Base)
+      .to receive(:skip_ssrf_protection?).and_return(true)
+    # rubocop:enable Rspec/AnyInstance
   end
 
   config.before(:each, stub_elasticsearch: true) do |_example|
diff --git a/vendor/cache/carrierwave-2.1.0.gem b/vendor/cache/carrierwave-2.1.0.gem
deleted file mode 100644
index b2f61f136..000000000
Binary files a/vendor/cache/carrierwave-2.1.0.gem and /dev/null differ
diff --git a/vendor/cache/carrierwave-2.1.1.gem b/vendor/cache/carrierwave-2.1.1.gem
new file mode 100644
index 000000000..39ed8e30d
Binary files /dev/null and b/vendor/cache/carrierwave-2.1.1.gem differ
diff --git a/vendor/cache/i18n-1.8.8.gem b/vendor/cache/i18n-1.8.8.gem
deleted file mode 100644
index f903721a1..000000000
Binary files a/vendor/cache/i18n-1.8.8.gem and /dev/null differ
diff --git a/vendor/cache/i18n-1.8.9.gem b/vendor/cache/i18n-1.8.9.gem
new file mode 100644
index 000000000..85b8fb989
Binary files /dev/null and b/vendor/cache/i18n-1.8.9.gem differ
diff --git a/vendor/cache/ssrf_filter-1.0.7.gem b/vendor/cache/ssrf_filter-1.0.7.gem
new file mode 100644
index 000000000..243a58aeb
Binary files /dev/null and b/vendor/cache/ssrf_filter-1.0.7.gem differ