Low severity · published Jul 10, 2026
CVE-2026-15326
halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal
3.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
halo · halo-dev
2.24.0; 2.24.1; 2.24.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15326
github.com
https://github.com/halo-dev/halo/
github.com
https://github.com/halo-dev/halo/issues/10062
vuldb.com
https://vuldb.com/cve/CVE-2026-15326
vuldb.com
https://vuldb.com/submit/853064
vuldb.com
https://vuldb.com/vuln/377265
vuldb.com
https://vuldb.com/vuln/377265/cti
More from halo
9.8
CVE-2022-32995
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function
9.8
CVE-2022-32994
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload
9.8
CVE-2020-18980
Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters
9.8
CVE-2020-21526
An Arbitrary file writing vulnerability in halo v1.1.3
9.8
CVE-2020-21523
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function