CVE-2026-36759: SSRF
Published Apr 30, 2026
·Updated
A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Affected Software
1 affected component
Halo Halo=2.22.14
Event History
Apr 30, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-36759?
CVE-2026-36759 has a high severity rating due to its potential for allowing internal resource scanning by authenticated attackers.
2
How do I fix CVE-2026-36759?
Fix CVE-2026-36759 by upgrading to a version of Halo later than v2.22.14 where the vulnerability is addressed.
3
Who is affected by CVE-2026-36759?
CVE-2026-36759 affects users of Halo version 2.22.14, particularly those with authentication enabled.
4
What specific feature contains the vulnerability in CVE-2026-36759?
CVE-2026-36759 is located in the /themes/{name}/upgrade-from-uri endpoint of the Halo application.
5
What type of vulnerability is CVE-2026-36759?
CVE-2026-36759 is classified as a Server-Side Request Forgery (SSRF) vulnerability.