Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

halo — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in halo, with AI-generated Chinese analysis, references, and POCs.

Vendor: halo-dev

CVE ID Title CVSS Severity Published
CVE-2026-97182 halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization CWE-707 7.3 High 2026-09-24
CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter CWE-601 6.1 Medium 2026-09-15
CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal CWE-22 4.7 Medium 2026-07-18
CVE-2026-15326 halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal CWE-22 3.8 Low 2026-07-10
CVE-2026-55439 Halo: Path Traversal in Backup Download Leads to Arbitrary File Read CWE-22 5.5 Medium 2026-06-25
CVE-2025-15141 Halo Configuration actuator information disclosure CWE-200 3.1 Low 2025-12-28
CVE-2025-14117 fit2cloud Halo cross-site request forgery CWE-352 4.3 Medium 2025-12-06
CVE-2024-56156 Halo Vulnerable to Stored XSS and RCE via File Upload Bypass CWE-79 9.0 - 2025-04-25
CVE-2024-43793 Halo's editor has a stored XSS vulnerability CWE-79 6.3 Medium 2024-09-11
CVE-2024-43792 Halo's editor has a stored Cross-Site Scripting vulnerability CWE-79 6.3 Medium 2024-09-02
CVE-2022-22125 Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag CWE-79 4.8 Medium 2022-01-13
CVE-2022-22124 Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image CWE-79 5.4 Medium 2022-01-13
CVE-2022-22123 Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title CWE-79 5.4 Medium 2022-01-13

All 13 known CVE vulnerabilities affecting halo with full Chinese analysis, references, and POCs where available.