High severity7.2NVD Advisory· Published Mar 18, 2026· Updated Jun 17, 2026
CVE-2026-28674
CVE-2026-28674
Description
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password (qweasd123456) and ignores file content. A background watcher (StartWatcher) then scans this folder every 5 seconds. If it finds a new executable, it runs it immediately, resulting in RCE. Version 4.0.0 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- danvei233/xiaoheiFSv5Range: < 0.4.0
Patches
Vulnerability mechanics
References
1- github.com/danvei233/xiaoheiFS/security/advisories/GHSA-hcj4-gfvq-qv4pnvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.