Every CVESearch/Get API key

CVE-2011-4106

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list...

6.8 MediumPublic exploit

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Exploit likelihood

23.3%Up 4.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used6.8

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Record
CVE-2011-4106
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Record
CVE-2011-4106
Updated
2026-11-02
EUVDEUVD-2011-4055No score

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Record
EUVD-2011-4055
Updated
2026-11-03
GitHub AdvisoriesGHSA-h589-v7r4-6pgfNo score

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list...

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

Record
GHSA-h589-v7r4-6pgf
Weakness
CWE-20
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBWordPress Plugin TimThumb 1.32 - Remote Code Execution2011-08-03
Exploit-DBMultiple WordPress Plugins - 'timthumb.php' File Upload2011-09-19

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4106 is a medium vulnerability (CVSS 6.8) in Binarymoon Timthumb, published October 26, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.3%, the 97th percentile. No source names a fixed version.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open