CVE-2006-4111
Ruby on Rails vulnerable to code injection
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
Exploit likelihood
What each source reports
NVD Score used
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- Updated
- 2026-11-02
EUVDEUVD-2017-0306 No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
EUVD-2017-0306- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvpq-5xqx-pfpp No score
Ruby on Rails vulnerable to code injection
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
GHSA-rvpq-5xqx-pfpp- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-4111 No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
DEBIAN-CVE-2006-4111- Updated
- 2026-11-02
OSVGHSA-rvpq-5xqx-pfpp No score
Ruby on Rails vulnerable to code injection
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
GHSA-rvpq-5xqx-pfpp- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4111 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published August 14, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in rails 1.1.6.
References
secunia.com/advisories/21466
securityfocus.com/bid/19454
vupen.com/english/advisories/2006/3237
blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html
novell.com/linux/security/advisories/2006_21_sr.html
Show 11 moreShow less
weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
gentoo.org/security/en/glsa/glsa-200608-20.xml
securitytracker.com/id?1016673
nvd.nist.gov/vuln/detail/CVE-2006-4111
github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454
security-tracker.debian.org/tracker/CVE-2006-4111