CVE-2025-44595

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the SpEL Handler component. Such manipulation leads to improper neutralization.

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components.

Halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in the /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url endpoint. The vulnerability allows sending requests from the server to arbitrary URLs.

A flaw was found in halo-dev halo up to version 2.27.0-beta.1 in the resolveViewNameOrDefault function of the DefaultViewNameResolver class, which handles view name resolution. Manipulating the template argument leads to path traversal, allowing access to files outside the intended directory. The vulnerability can be exploited remotely and a public exploit is already available.

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.

In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components.

A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the ThemeUtils.unzipThemeTo function of ThemeUtils.java during theme installation. Manipulating the metadata.name argument allows remote exploitation, and a public exploit is available.

Halo is an open source website building tool. Prior to version 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem.

A vulnerability in Halo up to version 2.21.10 affects some unknown processing in the file /actuator of the Configuration Handler component. Manipulation leads to information disclosure. The attack may be performed remotely but requires high complexity and is difficult to exploit. The exploit has been publicly disclosed.