CVE-2011-4106
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list...
CVE-2011-4106 is a medium vulnerability (CVSS 6.8) in Binarymoon Timthumb, published October 26, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.3%, the 97th percentile. No source names a fixed version.
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
Exploit likelihood
What each source reports
NVD Score used
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
- Record
CVE-2011-4106- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
- Record
CVE-2011-4106- Updated
- 2026-11-02
EUVDEUVD-2011-4055 No score
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
- Record
EUVD-2011-4055- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h589-v7r4-6pgf No score
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list...
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
- Record
GHSA-h589-v7r4-6pgf- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin TimThumb 1.32 - Remote Code Execution | 2011-08-03 |
| Exploit-DB | Multiple WordPress Plugins - 'timthumb.php' File Upload | 2011-09-19 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
exploit-db.com/exploits/17872
binarymoon.co.uk/2011/08/timthumb-2
markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack
openwall.com/lists/oss-security/2011/11/03/4
code.google.com/p/timthumb/issues/detail?id=212
nvd.nist.gov/vuln/detail/CVE-2011-4106
github.com/advisories/GHSA-h589-v7r4-6pgf