Remote Code Execution in Halo CMS

Executive Summary

CVE-2026-67920 is a critical arbitrary file write vulnerability in Halo CMS versions up to 2.25.4. It exists in the backup restoration functionality, specifically in the restoreWorkdir() method of MigrationServiceImpl.java. The flaw allows authenticated attackers with backup management privileges to craft malicious ZIP files containing arbitrary files, which are then written to the server's working directory without proper validation.

Useful 0 Not Useful 0

Detection Guidance

Check Halo application logs for suspicious backup restoration activities, particularly entries related to the /apis/console.api.migration.halo.run/v1alpha1/restorations endpoint. Look for unexpected file writes in the ~/.halo2/ directory or modifications to plugins, themes, or configuration files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Remote Code Execution (RCE) via plugin JAR replacement or authentication bypass through RSA key replacement. Exploitation can result in overwriting existing files, including plugins, RSA keys, themes, or configuration files. It may also enable stored XSS or security control bypass, allowing attackers to gain full control over the Halo instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to potential Remote Code Execution (RCE), authentication bypass, and unauthorized file overwrites. Exploitation may allow attackers to access, modify, or delete sensitive data, including personal or health information, violating confidentiality and integrity requirements of these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Halo to a patched version that includes validation in restoreWorkdir(). If immediate upgrade is not possible, restrict access to backup management features and disable the restoration endpoint. Implement file integrity monitoring for ~/.halo2/ and critical Halo directories.

Useful 0 Not Useful 0