CVE-2026-28673

Katalog CVE

CVSS 7.2 · High EPSS 0,86%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada danvei233 xiaoheifs. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danvei233/xiaoheiFS/security/advisories/GHSA-4vw4-5wmh-7x4v exploit · advisory vendor