CVE-2026-67920 | Halo 2.25.4 code injection

A vulnerability identified as critical has been detected in Halo 2.25.4. Impacted is the function run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir/org.springframework.util.FileSystemUtils.copyRecursively. Performing a manipulation results in code injection.

This vulnerability is cataloged as CVE-2026-67920. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More