Executive brief
Halo is an open-source website building platform used for blogs, knowledge bases, and e-commerce sites. Versions 2.25.4 and earlier contain a vulnerability in the plugin management system that allows attackers to install or update malicious plugins, leading to arbitrary command execution with the privileges of the Halo process. This could enable attackers to compromise the web server, steal data, or deploy further attacks.
Technical details
The vulnerability exists in Halo's plugin management feature (versions ≤ 2.25.4), which fails to properly validate or sanitize plugins during installation/update operations. The insufficient input validation allows attackers to upload malicious plugins that execute arbitrary commands with the permissions of the Halo process. The attack requires authenticated access to the plugin management interface, but once exploited, an attacker gains remote code execution (RCE) on the server. No patch information was provided in the advisory, but the issue is tracked as CVE-2026-78971.
Affected products
- Halo Halo ≤ 2.25.4
Timeline
- 2026-09-08: disclosed