halo vulnerabilities
CVEs whose affected-version data names the halo package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-116117High· 7.3halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/Defau…
CVE-2026-97182High· 7.3PoCA security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component…
CVE-2026-91772Medium· 6.1PoCHalo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbi…
CVE-2025-15141Low· 3.1A vulnerability was determined in Halo up to 2.21.10
A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be…
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may b…