What is CVE-2008-1117?

CVE-2008-1117 is a vulnerability in Netopia Timbuktu Pro, classified under Path Traversal. Published 2008-03-14.

Is CVE-2008-1117 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Netopia Timbuktu Pro

CVE-2008-1117

Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2008-03-14 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.695 (99.4th percentile), scored 2026-10-18.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.695 · newest: 0.695 · change: 0.000

Affected products

Netopia Timbuktu Pro — versions 8.6.5

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

rapid7/metasploit-framework

References

www.securityfocus.com/archive/1/489360/100/0/threaded (mailing-list)
www.exploit-db.com/exploits/4455 (exploit)
secunia.com/advisories/29316 (Vendor Advisory, third-party-advisory)
securityreason.com/securityalert/3741 (third-party-advisory)
www.coresecurity.com/
www.securityfocus.com/archive/1/489382/100/0/threaded (mailing-list)
aluigi.org/poc/timbuto.zip (Exploit)
www.securityfocus.com/bid/28081 (vdb-entry)
aluigi.altervista.org/adv/timbuto-adv.txt
www.securityfocus.com/archive/1/489414/100/0/threaded (mailing-list)

Frequently asked questions

What is CVE-2008-1117?: CVE-2008-1117 is a vulnerability in Netopia Timbuktu Pro, classified under Path Traversal. Published 2008-03-14.
Is CVE-2008-1117 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.