The vulnerability resides in the ThemeUtils.unzipThemeTo method of halo's Theme Installation component. By manipulating the argument metadata.name, an attacker can include directory traversal sequences that cause files to be written outside the intended theme directory, potentially allowing overwriting of files beyond the theme folder. The weakness is classified as CWE-22 and has a CVSS score of 5.1, indicating moderate severity.

halo‑dev halo versions up to 2.24.2 are affected. No information about versions beyond 2.24.2 is available.

The attack vector is remote and the exploit is publicly available, meaning an external actor can leverage the flaw. The flaw permits an attacker to write files to arbitrary locations on the filesystem by exploiting the unchecked metadata.name field, which could overwrite existing files and introduce malicious content. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The CVSS score of 5.1 reflects moderate severity. Though not listed in the CISA KEV catalog, the ability to overwrite files in a webroot elevates the potential impact, warranting prompt remediation.