CVE-2008-3195

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in...

6.8 MediumPublic exploitFix available

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.

Exploit likelihood

8.28%Up 6.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2008-3195
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-3195
Updated: 2026-11-02

EUVDEUVD-2008-3185 No score

Record: EUVD-2008-3185
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fqmr-q9vp-75fv No score

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in...

Record: GHSA-fqmr-q9vp-75fv
Weakness: CWE-22
Updated: 2026-11-02

Affected products

twiki

Affected packages

Affected packages
Package	Affected	Fixed
`twiki` Debian:4.0	before 1:4.0.5-9.1etch1, plus listed versions 1:4.0.5-9.1	1:4.0.5-9.1etch1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	TWiki 4.2.0 - 'configure' Remote File Disclosure	2008-08-19
Exploit-DB	TWiki 4.2.2 - 'action' Remote Code Execution	2008-09-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-3195 is a medium vulnerability (CVSS 6.8) in Twiki, published September 17, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.28%, the 94th percentile. Fixed in twiki 1:4.0.5-9.1etch1.

References

Show 7 moreShow less