CVE-2023-27164

MediumCVSS 4.8

Published: 10/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.69%

48th percentile - higher than 48% of all known CVEs

Summary

An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.

Risk Assessment

Attackers can take over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update Halo to the latest available version and implement file type validation and restrictions on executable file uploads.

Original NVD description (English source)

An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.