CVE-2008-1117: Timbuktu Pro Notes directory traversal allows arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication, and public exploit code enabling remote code execution makes this a critical risk.

What it is

The Notes (instant message) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows (and possibly 8.7 for Mac OS X) fails to properly sanitize destination filenames, allowing a backslash followed by ../ sequences to escape the intended upload directory. This is an incomplete fix for CVE-2007-4220, so the original traversal weakness remains reachable. Because the flaw permits writing files to arbitrary paths, it can lead to code execution when a file is placed in a Startup folder.

Impact

A remote attacker can write files to any location the Timbuktu Pro service can access, including Startup folders, which enables arbitrary code execution under the service account. This gives full compromise of the affected host.

Attack surface

The vulnerability is reachable over the network through the Notes/instant message file transfer functionality in tb2ftp.dll. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Public exploit code is referenced (Exploit-DB entries and an aluigi PoC tagged Exploit), and EPSS is 0.69473 (99.3rd percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix for Timbuktu Pro or upgrade to a version that fully addresses the incomplete CVE-2007-4220 fix; if no patch is available, remove or disable the product.
• Block or restrict network access to the Timbuktu Pro Notes/file transfer service (tb2ftp.dll) to trusted hosts only.
• Run the Timbuktu Pro service with least privilege and ensure its account cannot write to Startup folders or other sensitive directories.
• Monitor and restrict file writes from the service account to unexpected paths, especially Startup folders.

Detection

• Monitor file creation events in Startup folders and other sensitive directories for files written by the Timbuktu Pro service account.
• Inspect network traffic to the Timbuktu Pro file transfer port for filenames containing backslash followed by ../ sequences.
• Review Timbuktu Pro logs for Notes/instant message file transfers with unusual destination paths.
• Alert on unexpected executable or script files appearing in user or system Startup locations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.