Timbuktu contains a flaw that allows a remote attacker to upload files to arbitrary locations outside of the web path. The issue is due to the Flash Notes component not properly sanitizing user input, specifically failing to properly escape the '/' and '\' characters.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
Uncoordinated Disclosure
Solution
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
