CVE-2008-5275

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-28 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a (1) TAR or (2) ZIP archive. NOTE: this can be leveraged for code execution by creating a .php file.

Affected products

Net2Ftp: 0.96-stable, 0.97-beta

References

http://secunia.com/advisories/30611
http://vuln.sg/net2ftp096-en.html
http://www.securityfocus.com/bid/29664
https://exchange.xforce.ibmcloud.com/vulnerabilities/42994
http://secunia.com/advisories/30611
http://vuln.sg/net2ftp096-en.html
http://www.securityfocus.com/bid/29664
https://exchange.xforce.ibmcloud.com/vulnerabilities/42994

Get alerted when CVE-2008-5275 or the next vulnerability affects your stack