CVE-2006-4111
Ruby on Rails vulnerable to code injection
CVE-2006-4111 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published August 14, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. Fixed in rails 1.1.6.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.33%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.6rails +4 more
Description
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- Updated
- 2026-11-02
EUVDEUVD-2017-0306No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
EUVD-2017-0306- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvpq-5xqx-pfppNo score
Ruby on Rails vulnerable to code injection
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
GHSA-rvpq-5xqx-pfpp- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVNo score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
CVE-2006-4111- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-4111No score
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
DEBIAN-CVE-2006-4111- Updated
- 2026-11-02
OSVGHSA-rvpq-5xqx-pfppNo score
Ruby on Rails vulnerable to code injection
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
- Record
GHSA-rvpq-5xqx-pfpp- Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/21466
securityfocus.com/bid/19454
vupen.com/english/advisories/2006/3237
blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html
novell.com/linux/security/advisories/2006_21_sr.html
Show 11 moreShow less
weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
gentoo.org/security/en/glsa/glsa-200608-20.xml
securitytracker.com/id?1016673
nvd.nist.gov/vuln/detail/CVE-2006-4111
github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454
security-tracker.debian.org/tracker/CVE-2006-4111