CVE-2026-116117
halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 25, 2026
Description
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
halohalo-dev |
|
References
- VDB-426185 | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversalvdb-entrytechnical-description
- VDB-426185 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-116117 | CVE Analysis and Reportthird-party-advisory
- Submit #1004845 | halo-sigs Halo ≤ 2.27.0-beta.1 Arbitrary File Readthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.