EIP-2026-114491
PRE-CVEXtreme/Ditto News 1.0 - 'post.php' Remote File Inclusion
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-114491. PoCs published by Kacper.
AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in Xtreme/Ditto News v1.0, allowing an attacker to include and execute arbitrary remote scripts via the 'fil_config' parameter in the 'post.php' file.
Description
Xtreme/Ditto News 1.0 - 'post.php' Remote File Inclusion
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Kacper · textwebappsphp
https://www.exploit-db.com/exploits/1887
This exploit demonstrates a Remote File Include (RFI) vulnerability in Xtreme/Ditto News v1.0, allowing an attacker to include and execute arbitrary remote scripts via the 'fil_config' parameter in the 'post.php' file.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
Xtreme/Ditto News v1.0
No auth needed
Prerequisites:
Remote script hosting · Target server with vulnerable software
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Details
Status
pre_cve
Tracked Since
Feb 18, 2026