Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-28673 is a high-severity OS Command Injection (CWE-78) vulnerability in Danvei233 Xiaoheifs. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28673 is a remote code execution (RCE) vulnerability in xiaoheiFS, a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows administrators to upload a ZIP file containing a binary executable and a manifest.json file. The server trusts the "binaries" field specified in the manifest.json without validating the file's contents or behavior, directly executing the uploaded binary and enabling RCE. The issue is associated with CWE-78 and CWE-434, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires high privileges (PR:H), meaning an attacker must already possess administrative access to the xiaoheiFS instance. With admin rights, the attacker can upload a malicious ZIP archive via the plugin system over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants RCE on the server under the context of the xiaoheiFS process, allowing high-impact compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).
The GitHub security advisory (GHSA-4vw4-5wmh-7x4v) confirms the vulnerability and states that xiaoheiFS version 0.4.0 resolves the issue through proper validation of plugin binaries. Security practitioners should upgrade to version 0.4.0 or later and review admin access controls to mitigate risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12700
Vulnerability Data
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the…
more
`binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.1.1V1.2.5V1.2.8V15.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Input validation directly neutralizes or rejects special characters that would otherwise alter OS command structure.
Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.
Least privilege reduces the permissions available to any process that could be subverted by injected commands.
Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.
Secure engineering principles require proper neutralization of untrusted input before command construction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Hardened configuration baselines can enforce allowed file types and processing rules.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Secure-coding guidelines and security testing explicitly address restrictions on allowed file types and upload handling, reducing the risk that dangerous file uploads are accepted without validation.
Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.
Application allow-listing and pre-use scanning of received files directly blocks the introduction of executable content that has not been vetted, eliminating the primary vector for unrestricted dangerous file uploads.