CVE-2014-4663

no score yetEPSS 9.8%

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

EPSS: 9.8% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2014-07-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

binarymoon:timthumb
binarymoon:wordthumb

References

http://packetstormsecurity.com/files/127192/TimThumb-2.8.13-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2014/Jul/4
http://seclists.org/fulldisclosure/2014/Jun/117
http://seclists.org/oss-sec/2014/q2/689
http://secunia.com/advisories/59558

Check your stack JSON