Halo
by Halo Dev
Source repositories
CVEs (53)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-32995 | Cri | 0.65 | 9.8 | 0.18 | Jun 27, 2022 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. | ||
| CVE-2022-32994 | Cri | 0.65 | 9.8 | 0.19 | Jun 27, 2022 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. | ||
| CVE-2020-18980 | Cri | 0.64 | 9.8 | 0.01 | Jul 12, 2021 | Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. | ||
| CVE-2020-21526 | Cri | 0.64 | 9.8 | 0.02 | Sep 30, 2020 | An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it. | ||
| CVE-2020-21523 | Cri | 0.64 | 9.8 | 0.03 | Sep 30, 2020 | A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign… | ||
| CVE-2020-21522 | Cri | 0.64 | 9.8 | 0.02 | Sep 30, 2020 | An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, such as ftl files, .bashrc files in the user directory, and finally get the permissions of the operating system. | ||
| CVE-2026-67921 | Cri | 0.60 | 9.3 | 0.00 | Aug 18, 2026 | Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code. | ||
| CVE-2025-44594 | Cri | 0.59 | 9.1 | 0.00 | Sep 9, 2025 | halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url. | ||
| CVE-2020-19038 | Cri | 0.59 | 9.1 | 0.01 | Jul 12, 2021 | File Deletion vulnerability in Halo 0.4.3 via delBackup. | ||
| CVE-2020-21524 | Cri | 0.59 | 9.1 | 0.02 | Sep 30, 2020 | There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read… | ||
| CVE-2026-67919 | Cri | 0.57 | 9.8 | 0.01 | Aug 17, 2026 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components | ||
| CVE-2026-67920 | Hig | 0.50 | 8.8 | 0.01 | Aug 18, 2026 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components | ||
| CVE-2020-21527 | Hig | 0.50 | 7.7 | 0.01 | Sep 30, 2020 | There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal. | ||
| CVE-2025-70886 | Hig | 0.49 | 7.5 | 0.00 | Feb 12, 2026 | An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint | ||
| CVE-2022-26619 | Hig | 0.49 | 7.5 | 0.01 | Apr 5, 2022 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. | ||
| CVE-2020-23079 | Hig | 0.49 | 7.5 | 0.01 | Jul 12, 2021 | SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. | ||
| CVE-2020-21525 | Hig | 0.49 | 7.5 | 0.02 | Sep 30, 2020 | Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it. | ||
| CVE-2026-97182 | Hig | 0.47 | 7.3 | — | Sep 24, 2026 | A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to… | ||
| CVE-2019-19999 | Hig | 0.47 | 7.2 | 0.02 | Dec 26, 2019 | Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration. | ||
| CVE-2025-40846 | Hig | 0.46 | — | 0.00 | May 8, 2025 | Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack. The vulnerability… |
- risk 0.65cvss 9.8epss 0.18
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
- risk 0.65cvss 9.8epss 0.19
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
- risk 0.64cvss 9.8epss 0.01
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
- risk 0.64cvss 9.8epss 0.02
An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.
- risk 0.64cvss 9.8epss 0.03
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign…
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can overwrite some files, such as ftl files, .bashrc files in the user directory, and finally get the permissions of the operating system.
- risk 0.60cvss 9.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
- risk 0.59cvss 9.1epss 0.00
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
- risk 0.59cvss 9.1epss 0.01
File Deletion vulnerability in Halo 0.4.3 via delBackup.
- risk 0.59cvss 9.1epss 0.02
There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrations/wordpress) needs to parse the xml file, but it is not used for security defense, This vulnerability can detect the intranet, read…
- risk 0.57cvss 9.8epss 0.01
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components
- risk 0.50cvss 8.8epss 0.01
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components
- risk 0.50cvss 7.7epss 0.01
There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal.
- risk 0.49cvss 7.5epss 0.00
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
- risk 0.49cvss 7.5epss 0.01
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
- risk 0.49cvss 7.5epss 0.01
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
- risk 0.49cvss 7.5epss 0.02
Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.
- risk 0.47cvss 7.3epss —
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to…
- risk 0.47cvss 7.2epss 0.02
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
- risk 0.46cvss —epss 0.00
Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack. The vulnerability…
Page 1 of 3