Halo-dev Halo vulnerabilities

• halo-dev halo halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal CVE-2026-116117 6.9 MediumOctober 26, 2026
• halo-dev halo halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization CVE-2026-97182 6.9 MediumSeptember 24, 2026
• halo-dev halo Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter CVE-2026-91772 5.3 MediumSeptember 15, 2026
• halo-dev halo halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal CVE-2026-16088 5.1 MediumJuly 18, 2026
• halo-dev halo halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal CVE-2026-15326 5.1 MediumJuly 10, 2026
• halo-dev halo Halo: Path Traversal in Backup Download Leads to Arbitrary File Read CVE-2026-55439 5.5 MediumJune 25, 2026
• halo Halo Configuration actuator information disclosure CVE-2025-15141 2.3 LowDecember 28, 2025
• fit2cloud halo fit2cloud Halo cross-site request forgery CVE-2025-14117 5.3 MediumDecember 6, 2025
• halo Halo Vulnerable to Stored XSS and RCE via File Upload Bypass CVE-2024-56156 5.5 MediumApril 25, 2025
• halo Halo's editor has a stored XSS vulnerability CVE-2024-43793 6.3 MediumSeptember 11, 2024
• halo Halo's editor has a stored Cross-Site Scripting vulnerability CVE-2024-43792 6.3 MediumSeptember 2, 2024
• halo Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag CVE-2022-22125 4.8 MediumJanuary 13, 2022
• fit2cloud halo Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image CVE-2022-22124 5.4 MediumJanuary 13, 2022
• fit2cloud halo Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title CVE-2022-22123 5.4 MediumJanuary 13, 2022