CVE-2008-6584 — html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory

Back Back to CVE browser

MEDIUM

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory

Published Apr 3, 2009

6.0

MEDIUM

CVSS 2.0

EPSS 2.03%

Description

html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory.

Affected products

Remediation

No remediation recorded yet.

Metrics

2.03% 0.02026

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02026

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.03% (0.02026)	80.28th	v5 (v2026.06.15)
Jun 15, 2026	2.03% (0.02026)	78.40th	v5 (v2026.06.15)
Mar 17, 2025	2.06% (0.02058)	82.69th	v4 (v2025.03.14)
Dec 17, 2024	2.39% (0.02387)	89.56th	v3 (v2023.03.01)
May 21, 2024	1.24% (0.01238)	85.43th	v3 (v2023.03.01)
May 22, 2023	1.24% (0.01238)	83.43th	v3 (v2023.03.01)
Apr 6, 2023	1.40% (0.01400)	84.39th	v3 (v2023.03.01)
Mar 7, 2023	1.39% (0.01392)	84.29th	v3 (v2023.03.01)
Mar 6, 2023	5.30% (0.05302)	89.90th	v2 (v2022.01.01)
Apr 1, 2022	5.30% (0.05302)	88.88th	v2 (v2022.01.01)
Feb 4, 2022	5.30% (0.05302)	76.02th	v2 (v2022.01.01)

Weaknesses (1)

CWE-94

Code Injection

References (5)

http://osvdb.org/44645
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/29935
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/491066/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/28846
vdb-entryx_refsource_BIDExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/41925
vdb-entryx_refsource_XF

Link	Providers	Tags
http://osvdb.org/44645		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/29935		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/491066/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/28846		vdb-entryx_refsource_BIDExploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/41925		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 3, 2009

Updated Aug 7, 2024

Reserved Apr 3, 2009

Link CVE-2008-6584

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2008-6584

Red Hat

Severity n/a

Public date n/a

Links CVE-2008-6584