Halo Dev vulnerabilities
12 vulnerabilities
Known vulnerabilities in Halo Dev products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Halo12 vulnerabilities
RoutineCVE-2026-116117halo-dev · halohalo-dev halo View Name Resolver DefaultViewNameResolver.java path traversalA flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.5HighEPSS0.50%RoutineCVE-2026-97182halo-dev · halohalo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralizationA security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.5HighEPSS0.37%RoutineCVE-2026-91772halo-dev · haloHalo through 2.26.1 Open Redirect via Unvalidated URI ParameterHalo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.CVSS6.1MediumEPSS0.32%RoutineCVE-2026-16088halo-dev · halohalo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversalA vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.CVSS5.8MediumEPSS0.49%RoutineCVE-2026-15326halo-dev · halohalo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversalA vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.CVSS5.1MediumEPSS0.54%RoutineCVE-2026-55439halo-dev · haloHalo: Path Traversal in Backup Download Leads to Arbitrary File ReadHalo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.CVSS5.5MediumEPSS0.41%RoutineCVE-2024-56156halo-dev · halo +1 moreHalo Vulnerable to Stored XSS and RCE via File Upload BypassHalo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.CVSS9.0CriticalEPSS0.83%RoutineCVE-2024-43793halo-dev · halo +1 moreHalo's editor has a stored XSS vulnerabilityHalo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0.CVSS6.4MediumEPSS0.33%RoutineCVE-2024-43792halo-dev · halo +1 moreHalo's editor has a stored Cross-Site Scripting vulnerabilityHalo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.CVSS6.3MediumEPSS0.35%RoutineCVE-2022-22125halo-dev · halo +1 moreHalo CMS - Stored Cross-Site Scripting (XSS) in Article's TagIn Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server.CVSS4.8MediumEPSS0.83%RoutineCVE-2022-22124halo-dev · halo +1 moreHalo CMS - Stored Cross-Site Scripting (XSS) in Profile ImageIn Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.CVSS5.4MediumEPSS0.71%RoutineCVE-2022-22123halo-dev · halo +1 moreHalo CMS - Stored Cross-Site Scripting (XSS) in Article's TitleIn Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.CVSS5.4MediumEPSS0.71%