CVE-2026-16088
Received Received - Intake

Path Traversal in Halo CMS via MigrationEndpoint

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulDB

Description
A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2026-16088
EUVD
EUVD-2026-45369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
halo-dev halo to 2.24.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the Halo open-source website-building tool up to version 2.24.2. It affects the Download function in the MigrationEndpoint.java file of the Files Backup Endpoint component. Attackers can remotely manipulate file paths to access unauthorized files on the server by exploiting improper filename sanitization during backup downloads.

Detection Guidance

Check Halo admin backend logs for suspicious backup download requests. Inspect network traffic for unusual file access patterns. Verify if any user accessed the MigrationEndpoint.java component or backup download features without proper authorization.

Impact Analysis

This vulnerability allows attackers to read arbitrary files on the server, including sensitive system files. It requires authentication to exploit but enables unauthorized access to confidential data. The public exploit increases the risk of real-world attacks. Affected users should upgrade to a patched version immediately.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. Exploitation may result in regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Halo to a version beyond 2.24.2 immediately. Disable backup download features if not required. Implement strict input validation for filenames in backup endpoints. Review and restrict admin backend access permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart