The vulnerability permits an administrator to upload any file through the AdminPaymentPluginUpload endpoint, without validating file type or content beyond checking a hard‑coded password (qweasd123456). When an executable file is placed in the plugins/payment directory, a background watcher automatically detects and runs it, giving attackers the ability to execute arbitrary code on the server. The flaw is an unrestricted file upload coupled with hard‑coded credentials, reflected by CWE-434 and CWE-798.

The affected product is xiaoheiFS, a self‑hosted financial and operational system used by cloud service businesses, developed by danvei233. All releases up to and including version 0.3.15 are vulnerable. The information in the advisory states that version 4.0.0 contains the fix.

The CVSS score of 7.2 indicates a moderate to high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog. An attacker who has obtained the hard‑coded password can simply upload a malicious executable; the system will immediately execute it with system privileges, without the need for additional network or privilege escalation steps. The attack path is therefore straightforward, making the risk significant for any compromised or exposed account.