An issue has been identified in Halo CMS version 2.25.4 that permits remote attackers to execute arbitrary code on the host system. The vulnerability arises from the restoreWorkdir() method in the MigrationServiceImpl class, which in turn relies on Spring's FileSystemUtils.copyRecursively(). When an attacker supplies crafted input to these components, the application can write and execute files outside the intended workspace. This lack of input validation and unsafe file operations enables full code execution and direct compromise of the underlying operating system.

Halo CMS version 2.25.4 is affected. No other vendors or products are listed, and the integral functionality is the migration service used to restore application work directories during data import processes. Users should verify whether they deploy this specific version and whether the migration endpoint is enabled.

The CVSS score is not reported, and EPSS data is unavailable. Nevertheless, the exploitation path is straightforward: a remote user can invoke the vulnerable migration endpoint, supply a malicious payload, and trigger a file system operation that places arbitrary scripts on the host. Once the file is present, the application can run it under its service account, granting the attacker command execution with the application's privileges. Because the vulnerability is accessible over HTTP and does not require privileged authentication, the likelihood of exploitation is high. The vulnerability is not yet listed in the CISA KEV catalog, but the lack of mitigations in the affected release means the risk remains significant.