CVE-2026-15326

LOW 3.8

halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal

CVSS Score

3.8

EPSS Score

0.4%

EPSS Percentile

29th

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.

CWE	CWE-22
Vendor	halo-dev
Product	halo
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for halo-dev halo

Be the first to know when new low vulnerabilities affecting halo-dev halo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

halo-dev / halo

2.24.0 2.24.1 2.24.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377265 vuldb.com: https://vuldb.com/vuln/377265/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15326 vuldb.com: https://vuldb.com/submit/853064 github.com: https://github.com/halo-dev/halo/issues/10062 github.com: https://github.com/halo-dev/halo/

Credits

🔍 rekczh (VulDB User) VulDB CNA Team