CVE-2008-1117
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in...
CVE-2008-1117 is a high vulnerability (CVSS 10.0) in Netopia Timbuktu Pro, published March 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.5%, the 99th percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 69.5%EPSS, 99th percentile
- Exploitation
- None known4 public exploits
- Fixed in
- No fix listedNo source names one
Description
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Motorola Timbuktu Pro 8.6.5 - File Deletion/Creation | 2008-03-11 |
| Exploit-DB | Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection | 2008-03-11 |
| Metasploit | Timbuktu Pro Directory Traversal/File Upload | 2008-05-10 |
| Exploit-DB | Motorola Timbuktu Pro - Directory Traversal / Arbitrary File Upload (Metasploit) | 2010-11-24 |
What each source reports
NVD Score used
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
CVE-2008-1117- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
CVE-2008-1117- Updated
- 2026-11-02
EUVDEUVD-2008-1126No score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
EUVD-2008-1126- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-53fw-gq2m-wgwvNo score
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in...
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
- Record
GHSA-53fw-gq2m-wgwv- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.