CVE-2026-67920
Received Received - Intake

Remote Code Execution in Halo CMS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: MITRE

Description
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-67920
EUVD
EUVD-2026-61093

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
halo-dev halo to 2.25.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67920 is a critical arbitrary file write vulnerability in Halo CMS versions up to 2.25.4. It exists in the backup restoration functionality, specifically in the restoreWorkdir() method of MigrationServiceImpl.java. The flaw allows authenticated attackers with backup management privileges to craft malicious ZIP files containing arbitrary files, which are then written to the server's working directory without proper validation.

Detection Guidance

Check Halo application logs for suspicious backup restoration activities, particularly entries related to the /apis/console.api.migration.halo.run/v1alpha1/restorations endpoint. Look for unexpected file writes in the ~/.halo2/ directory or modifications to plugins, themes, or configuration files.

Impact Analysis

This vulnerability can lead to Remote Code Execution (RCE) via plugin JAR replacement or authentication bypass through RSA key replacement. Exploitation can result in overwriting existing files, including plugins, RSA keys, themes, or configuration files. It may also enable stored XSS or security control bypass, allowing attackers to gain full control over the Halo instance.

Mitigation Strategies

Upgrade Halo to a patched version that includes validation in restoreWorkdir(). If immediate upgrade is not possible, restrict access to backup management features and disable the restoration endpoint. Implement file integrity monitoring for ~/.halo2/ and critical Halo directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart