Description
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Path traversal leading to unauthorized file access
Action: Patch
AI Analysis

Impact

The vulnerability resides in the DefaultViewNameResolver.resolveViewNameOrDefault function of halo’s view naming component. By manipulating the template argument, an attacker can cause the implementation to resolve a file path outside the intended directory, exposing local files. This flaw is a classic path‑traversal weakness (CWE‑22).

Affected Systems

halo‑dev’s halo application, versions up to 2.27.0‑beta.1, is affected. Any installation of these releases that exposes the DefaultViewNameResolver endpoint is susceptible.

Risk and Exploitability

With a CVSS score of 6.9, the weakness is of moderate severity. The exploit is published and can be launched remotely without local authentication, though the EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog. The attack path simply requires supplying a crafted template argument to the resolver function, which directly influences the resolved file path.

Generated by OpenCVE AI on October 26, 2026 at 05:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade halo to a version newer than 2.27.0‑beta.1.
  • If upgrading is not immediately possible, restrict access to the affected endpoint to trusted users or block it entirely for untrusted traffic.
  • Apply input validation or sanitization for the template parameter to reject path‑traversal sequences before they reach the resolver function.

Generated by OpenCVE AI on October 26, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
First Time appeared Halo
Halo halo
Weaknesses CWE-22
CPEs cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*
Vendors & Products Halo
Halo halo
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Halo Halo
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T04:15:13.200Z

Reserved: 2026-10-25T09:07:57.368Z

Link: CVE-2026-116117

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T05:17:54.180

Modified: 2026-10-26T05:17:54.317

Link: CVE-2026-116117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T05:45:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')