CVE-2026-28673xiaoheiFS is a self-hosted financial and operational system for cloud service businesses.
Updated under an hour ago ()
Does this affect you?
It affects danvei233 xiaoheifs. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.
- CVSS
- 7.2 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78, CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
danvei233 xiaoheifs danvei233:xiaoheifs | before 0.4.0 | NVD |
References
- https://github.com/danvei233/xiaoheiFS/security/advisories/GHSA-4vw4-5wmh-7x4vexploit, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.