Halo-dev vulnerabilities
We track 3 vulnerabilities in Halo-dev products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest Halo-dev vulnerabilities
- 7.3 High severity
halo: Improper Limitation of a Pathname to a Restricted Directory
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java
- 7.3 High severity
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1.
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such man
- 9.0 Critical severity
halo: Improper Neutralization of Input During Web Page Generation
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to