CVE-2026-97182
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 24, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 24, 2026
Description
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Halohalo-dev |
|
References
- VDB-409299 | halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralizationvdb-entry
- VDB-409299 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-97182 | CVE Analysis and Reportthird-party-advisory
- Submit #907507 | halo-dev Halo 2.15.0 through 2.25.4 Improper Neutralization of Special Elements used in an Expressiothird-party-advisory
- https://note-hxlab.wetolink.com/share/jTI97vuXfcCYexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.