CVE-2026-15326
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the ThemeUtils.unzipThemeTo function of ThemeUtils.java during theme installation. Manipulating the metadata.name argument allows remote exploitation, and a public exploit is available.
Risk Assessment
An attacker can remotely overwrite or read arbitrary files on the system, compromising data integrity and confidentiality, potentially leading to full application takeover.
Recommendation
Immediately upgrade halo to a version newer than 2.24.2 if available, or apply temporary mitigations such as input validation in the unzipThemeTo function.
Other vulnerabilities in halo
See all- CVE-2026-97182High
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the SpEL Handler component. Such manipulation leads to improper neutralization.
- CVE-2026-67919Critical
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components.
- CVE-2026-91772Medium
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
- CVE-2026-78971Medium
In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.
- CVE-2026-67920High
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components.
- CVE-2026-55439Medium
Halo is an open source website building tool. Prior to version 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem.
- CVE-2025-15141Low
A vulnerability in Halo up to version 2.21.10 affects some unknown processing in the file /actuator of the Configuration Handler component. Manipulation leads to information disclosure. The attack may be performed remotely but requires high complexity and is difficult to exploit. The exploit has been publicly disclosed.
- CVE-2025-51857Medium
An XSS vulnerability in the reconcile method of the AttachmentReconciler class in Halo system v.2.20.18LTS and earlier allows an attacker to inject malicious scripts.
- CVE-2023-27164Medium
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
Original NVD description (English source)
A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS