CVE-2026-116117 | halo-dev halo up to 2.27.0-beta.1 View Name Resolver DefaultViewNameResolver.java template path traversal

October 25, 2026 Yanac

A vulnerability labeled as critical has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal.

The identification of this vulnerability is CVE-2026-116117. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More