CVE-2026-116117: halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Deployments of halo-dev halo up to version 2.27.0-beta.1 should be prioritized. The issue is remotely reachable and requires no privileges or user interaction according to the supplied vector.
What does an attacker need to exploit this issue?
An attacker needs to manipulate the template argument processed by DefaultViewNameResolver.resolveViewNameOrDefault. The attack complexity is listed as low, and a public exploit has been published.
What is the potential impact if exploitation succeeds?
Successful exploitation can result in path traversal through the View Name Resolver component. The provided severity vector indicates low impact to confidentiality, integrity, and availability.
Is a vendor fix or workaround identified in the available information?
No fix, workaround, or mitigation is provided in the available information. The vendor was contacted but did not respond.