CVE-2026-28673

ALTO 7.2CVE-2026-28673 · Published 18/03/2026 · updated 17/06/2026

In breve

CVE-2026-28673 è una vulnerabilità ALTO (CVSS 7.2) che riguarda xiaoheifs (danvei233).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.63%, superiore al 50.2% delle vulnerabilità.
Correzione: aggiornare a 0.4.0 o successiva.

Package	Affected versions	Patched versions
xiaoheifs danvei233	`< 0.4.0`	`0.4.0`

Description

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.

References

danvei233/xiaoheiFS security advisory · Exploit

Altre vulnerabilità di xiaoheifs

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free