Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Halo 2.25.4: Remote Code Execution Through Malicious File Operations

CVE-2026-67920 · published 2 months ago
Summary

A security issue in Halo 2.25.4 allows an attacker to run unauthorized code on your server if they can trick it into processing a malicious file. This could potentially lead to unauthorized access or data theft. We recommend updating Halo to the latest version to fix this issue.

Original advisory text
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.co...
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components
References
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
Timeline
Published18 Aug 2026
Updated3 Nov 2026
First seen18 Aug 2026
Sources
CVE-2026-67920 · NVD
CVE-2026-67920 · MITRE
Track software like this
Free during beta