Unrated severityNVD Advisory· Published Dec 11, 2025· Updated Apr 7, 2026
xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature
CVE-2024-58313
Description
xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
3- www.exploit-db.com/exploits/51909mitreexploit
- www.vulncheck.com/advisories/xbtitfm-insecure-file-upload-in-filehosting-featuremitrethird-party-advisory
- xbtitfm.eumitreproduct
News mentions
0No linked articles in our index yet.