CVE-2026-97182: halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which Halo versions should be treated as affected?
The vulnerability is reported in halo-dev Halo up to versions 2.25.4 and 2.26.1. The provided data does not identify a fixed version beyond those affected version lines.
Can this be exploited remotely without an authenticated account?
The supplied severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. The issue is therefore assessed as remotely exploitable without authentication or victim interaction.
Is there public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, which increases the likelihood of attempted exploitation.
What component should be prioritized for investigation?
Prioritize the SpEL Handler, specifically the ReplyNotificationSubscriptionHelper.java file at application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java. The reported weakness is improper neutralization/input validation in an unknown function of that file.