# CVE-2026-16088: halo-dev Halo path traversal in Files Backup Endpoint

Source: https://junglewise.ai/threats/cve-2026-16088-halo-dev-halo-path-traversal-in-files-backup-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16088 · Severity: medium · CVSS 4.7 · Published 2026-07-18

Halo, an open-source website builder and content management system, contains a security flaw in its file backup component. An attacker with administrative privileges can exploit this to access or manipulate files outside of the intended backup directory. This could lead to the exposure of sensitive system information or unauthorized changes to the server's file system.

Technologies: [Halo](https://junglewise.ai/threats/technologies/halo). Vendors: [Halo](https://junglewise.ai/threats/vendors/halo).

## Quick answers

**Is CVE-2026-16088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16088 being exploited in the wild.

**How severe is CVE-2026-16088?** Medium severity, with a CVSS score of 4.7, published 18 July 2026.

**Which products and versions are affected?** Halo up to 2.24.2.

**Is there a fix for CVE-2026-16088?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16088 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16088?** Check whether you run Halo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the MigrationEndpoint.java file of the halo-dev/halo project. The flaw is located within the 'Download' function of the Files Backup Endpoint. A remote attacker with high privileges (PR:H) can provide manipulated input to bypass directory restrictions. This allows for arbitrary file access or manipulation on the underlying server. The vulnerability affects versions up to 2.24.2, and public exploit details have been disclosed.

## Affected products

- halo-dev Halo up to 2.24.2

## Timeline

- 2026-07-18: disclosed: Vulnerability published via VulDB and NVD

## References

- [https://github.com/halo-dev/halo/](https://github.com/halo-dev/halo/)
- [https://github.com/halo-dev/halo/issues/10064](https://github.com/halo-dev/halo/issues/10064)
- [https://vuldb.com/cve/CVE-2026-16088](https://vuldb.com/cve/CVE-2026-16088)
- [https://vuldb.com/submit/853097](https://vuldb.com/submit/853097)
- [https://vuldb.com/vuln/379798](https://vuldb.com/vuln/379798)
- [https://vuldb.com/vuln/379798/cti](https://vuldb.com/vuln/379798/cti)

## Related threats

- [Halo open redirect vulnerability in thumbnail endpoint](https://junglewise.ai/threats/cve-2026-91772-halo-open-redirect-vulnerability-in-thumbnail-endpoint)
- [Halo CMS plugin management arbitrary code execution](https://junglewise.ai/threats/cve-2026-78971-halo-cms-plugin-management-arbitrary-code-execution)
- [halo-dev Halo path traversal in Theme Installation](https://junglewise.ai/threats/cve-2026-15326-halo-dev-halo-path-traversal-in-theme-installation)
- [Halo path traversal in backup download endpoint](https://junglewise.ai/threats/cve-2026-55439-halo-path-traversal-in-backup-download-endpoint)
- [A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator…](https://junglewise.ai/threats/cve-2025-15141-a-vulnerability-was-determined-in-halo-up-to-2-21-10-this-issue)