Is CVE-2026-16088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16088 being exploited in the wild.

How severe is CVE-2026-16088?

Medium severity, with a CVSS score of 4.7, published 18 July 2026.

Is there a fix for CVE-2026-16088?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16088 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-16088?

Check whether you run Halo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16088: halo-dev Halo path traversal in Files Backup Endpoint

CVE-2026-16088 · Severity: medium · CVSS 4.7 · Published 2026-07-18

Halo, an open-source website builder and content management system, contains a security flaw in its file backup component. An attacker with administrative privileges can exploit this to access or manipulate files outside of the intended backup directory. This could lead to the exposure of sensitive system information or unauthorized changes to the server's file system.

Technologies: Halo. Vendors: Halo.

Quick answers

Is CVE-2026-16088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16088 being exploited in the wild.
How severe is CVE-2026-16088?: Medium severity, with a CVSS score of 4.7, published 18 July 2026.
Which products and versions are affected?: Halo up to 2.24.2.
Is there a fix for CVE-2026-16088?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16088 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-16088?: Check whether you run Halo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the MigrationEndpoint.java file of the halo-dev/halo project. The flaw is located within the 'Download' function of the Files Backup Endpoint. A remote attacker with high privileges (PR:H) can provide manipulated input to bypass directory restrictions. This allows for arbitrary file access or manipulation on the underlying server. The vulnerability affects versions up to 2.24.2, and public exploit details have been disclosed.

Affected products

halo-dev Halo up to 2.24.2

Timeline

2026-07-18: disclosed: Vulnerability published via VulDB and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.