VULNERABILITY INTELLIGENCE

CVE-2024-58313

CVSS score7.2 HIGH
EPSS probability0.61%
CISA KEVNot currently listed
Published2025-12-11
Last modified2026-10-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.

Weakness classification

  • disclosure@vulncheck.com: CWE-434

Primary references