A flaw in Halo CMS version 2.25.4 allows a remote attacker to craft a migration request that triggers run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir() and uses org.springframework.util.FileSystemUtils.copyRecursively(). This combination can be exploited to write files to arbitrary locations on the server, which in turn enables the attacker to execute arbitrary code on the host system.

Halo CMS 2.25.4 is the only documented vulnerable product; no other vendors or product variants are listed. The vulnerability resides in the migration service that restores application work directories during data import processes.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a presently low probability of exploitation. The description does not explicitly state whether the migration endpoint requires privileged or authenticated access; it remains uncertain. Based on the description, it is inferred that the attacker would send a remote HTTP request to the migration endpoint, and that file copy operations may provide a path to execute code with the privileges of the service account. The flaw is not listed in CISA’s KEV catalog, but the lack of default mitigations keeps the risk significant.