CVE-2026-15326
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the ThemeUtils.unzipThemeTo function of ThemeUtils.java during theme installation. Manipulating the metadata.name argument allows remote exploitation, and a public exploit is available.
Risk Assessment
An attacker can remotely overwrite or read arbitrary files on the system, compromising data integrity and confidentiality, potentially leading to full application takeover.
Recommendation
Immediately upgrade halo to a version newer than 2.24.2 if available, or apply temporary mitigations such as input validation in the unzipThemeTo function.
Original NVD description (English source)
A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.