CVE Catalog
CVE-2026-67919
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.29%
22th percentile - higher than 22% of all known CVEs
Summary
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components.
Risk Assessment
A remote attacker could execute arbitrary code on the server, potentially leading to full system compromise, data theft, or service disruption.
Recommendation
It is recommended to update Halo to the latest version that includes security fixes and restrict access to plugin installation.
Original NVD description (English source)
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components