CVE-2026-97182
Deferred Deferred - Pending Action

Improper Neutralization in Halo Dev Halo via SpEL Handler

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97182
EUVD
EUVD-2026-85859

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
halo-dev halo From 2.15.0 (inc) to 2.25.4 (inc)
halo-dev halo to 2.26.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-97182 is an Expression Language Injection flaw in Halo versions 2.15.0 through 2.25.4. It allows attackers to manipulate comment reply email notifications by injecting malicious Spring Expression Language (SpEL) code. The issue occurs when guest comments are enabled and Halo processes email addresses without properly escaping single quotes, enabling unauthorized data disclosure.

Detection Guidance

Check if guest comments are enabled in Halo settings. Inspect the ReplyNotificationSubscriptionHelper.java file for improper neutralization of input. Monitor email notifications for unexpected recipients or content leaks. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to receive email notifications containing sensitive comment content they should not have access to. It requires guest comments to be enabled and reply notifications configured. Attackers could exploit it to exfiltrate data from unrelated comments when other users reply to approved comments.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal data, potentially violating GDPR's data protection requirements and HIPAA's privacy rules. It may result in unauthorized access to sensitive information, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies

Disable guest comments if not required. Update Halo to a patched version. Escape single quotes in the identity name before interpolation in ReplyNotificationSubscriptionHelper.java. Review and restrict email notification configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart