CVE-2008-1117
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in...
CVE-2008-1117 is a high vulnerability (CVSS 10.0) in Netopia Timbuktu Pro, published March 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.5%, the 99th percentile. No source names a fixed version.
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
CVE-2008-1117- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
CVE-2008-1117- Updated
- 2026-11-02
EUVDEUVD-2008-1126 No score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
EUVD-2008-1126- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-53fw-gq2m-wgwv No score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in...
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
GHSA-53fw-gq2m-wgwv- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Motorola Timbuktu Pro - Directory Traversal / Arbitrary File Upload (Metasploit) | 2010-11-24 |
| Exploit-DB | Motorola Timbuktu Pro 8.6.5 - File Deletion/Creation | 2008-03-11 |
| Exploit-DB | Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection | 2008-03-11 |
| Metasploit | Timbuktu Pro Directory Traversal/File Upload | 2008-05-10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
References
securityfocus.com/archive/1/489360/100/0/threaded
exploit-db.com/exploits/4455
secunia.com/advisories/29316
securityreason.com/securityalert/3741
coresecurity.com?action=item&id=2166