CVE-2026-28674 Overview
CVE-2026-28674 is an unrestricted file upload vulnerability in xiaoheiFS, a self-hosted financial and operational system designed for cloud service businesses. The vulnerability exists in versions up to and including 0.3.15 and allows authenticated administrators to upload arbitrary files to the plugins/payment/ directory through the AdminPaymentPluginUpload endpoint. A background file watcher service (StartWatcher) scans this directory every 5 seconds, and when it detects a new executable, it runs the file immediately—resulting in remote code execution on the host system.
Critical Impact
Authenticated administrators can achieve full remote code execution on the server by uploading a malicious executable that is automatically executed by the background watcher service.
Affected Products
- xiaoheiFS versions up to and including 0.3.15
Discovery Timeline
- 2026-03-18 - CVE-2026-28674 published to NVD
- 2026-03-18 - Last updated in NVD database
Technical Details for CVE-2026-28674
Vulnerability Analysis
This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The AdminPaymentPluginUpload endpoint lacks proper file validation, accepting any file type regardless of content or extension. The only authentication mechanism is a hardcoded password (qweasd123456), which provides minimal security.
The critical flaw is compounded by the StartWatcher background service, which operates on a 5-second polling interval to detect new files in the plugins/payment/ directory. When a new executable is detected, it is immediately executed with the same privileges as the xiaoheiFS application. This design creates a dangerous execution pipeline that converts a file upload vulnerability into guaranteed remote code execution.
Root Cause
The root cause is a combination of two security failures: insufficient file upload validation in the AdminPaymentPluginUpload endpoint, and an insecure automated execution mechanism in the StartWatcher service. The endpoint only validates against a hardcoded password and completely ignores file content, extension, and type. The background watcher then blindly executes any new executable it finds, without signature verification or sandboxing.
Attack Vector
The attack is network-based and requires high privileges (administrator access). An attacker with knowledge of the hardcoded password can upload a malicious executable file to the plugins/payment/ directory via the AdminPaymentPluginUpload endpoint. Within 5 seconds, the StartWatcher service detects the new file and executes it, granting the attacker code execution on the target server. The hardcoded password significantly lowers the barrier to exploitation, as it is publicly documented and cannot be changed by administrators.
Detection Methods for CVE-2026-28674
Indicators of Compromise
- Unexpected files appearing in the plugins/payment/ directory, particularly executable files not part of legitimate payment plugins
- Process execution events originating from the xiaoheiFS application with unusual command-line arguments or spawning unfamiliar child processes
- Network authentication attempts to the AdminPaymentPluginUpload endpoint, especially from external or unknown IP addresses
Detection Strategies
- Monitor HTTP POST requests to the AdminPaymentPluginUpload endpoint for suspicious file uploads
- Implement file integrity monitoring on the plugins/payment/ directory to detect unauthorized file additions
- Analyze process trees to identify unexpected executables spawned by the xiaoheiFS service
Monitoring Recommendations
- Deploy endpoint detection and response (EDR) solutions to monitor for unusual process execution patterns associated with the xiaoheiFS application
- Configure web application firewalls (WAF) to inspect and log traffic to administrative upload endpoints
- Establish baseline behavior for the StartWatcher service and alert on deviations
How to Mitigate CVE-2026-28674
Immediate Actions Required
- Upgrade xiaoheiFS to version 4.0.0 or later, which addresses this vulnerability
- If immediate upgrade is not possible, restrict network access to the administrative endpoints at the firewall or reverse proxy level
- Monitor the plugins/payment/ directory for any unauthorized file additions and remove suspicious files immediately
Patch Information
Version 4.0.0 of xiaoheiFS fixes this vulnerability. Review the GitHub Security Advisory for complete patch details and upgrade instructions.
Workarounds
- Block external access to the AdminPaymentPluginUpload endpoint using firewall rules or reverse proxy configuration
- Disable or stop the StartWatcher service if payment plugin functionality is not required
- Implement additional authentication layers (such as IP allowlisting or multi-factor authentication) in front of administrative endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
