Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck

CVE-2024-58313xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature

High 8.6

In plain English

A high-severity unrestricted file upload in xbtitFM from xbtitfm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.

Affected products (as reported)

Vendor	Product	Versions
xbtitfm	xbtitFM	4.1.18

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

ExploitDB-51909 exploit
Official Vendor Homepage product
VulnCheck Advisory: xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature third-party-advisory