CVE-2026-67919 in Halo
Summary
by MITRE • 08/18/2026
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified involves a critical flaw within the Halo content management system version 2.25.4, specifically affecting its plugin installation mechanism. The core of this issue resides in the interaction between the PluginEndpoint class, which handles incoming requests for plugin operations, and the DefaultPluginApplicationContextFactory responsible for initializing these plugins. When an attacker sends a specially crafted request to the installFromUri method, they can manipulate the input parameters to bypass intended security controls. This flaw allows for remote code execution because the system fails to adequately validate or sanitize the URI provided by the user before attempting to load and instantiate the plugin classes contained within it.
This vulnerability is classified under CWE-94 as Improper Control of Generation of Code, often referred to as injection flaws, specifically in contexts where dynamic class loading occurs without sufficient verification of the source code's integrity. The attack vector leverages Java’s reflection capabilities or classloader mechanisms inherent in the Spring-based architecture of Halo. By supplying a malicious URI that points to an attacker-controlled artifact, such as a JAR file hosted on a remote server, the application retrieves and loads this external code into its runtime environment. Because the plugin context is initialized with elevated privileges relative to standard user operations, the loaded classes execute within the security boundary of the Halo process itself.
The operational impact of this vulnerability is severe, resulting in full remote code execution on the host system running the affected software. An attacker who exploits this flaw can achieve arbitrary command execution, potentially leading to complete compromise of the underlying operating system. This includes the ability to read sensitive configuration files, exfiltrate database credentials stored within the application context, modify or delete content managed by Halo, and pivot further into internal network segments if the server is accessible from there. The lack of input validation on the URI parameter means that no authentication or authorization checks can reliably prevent this exploitation once the endpoint is reachable over the network.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables an attacker to execute arbitrary commands within the application environment. It also relates to T1204 User Execution if social engineering is used to trick an administrator into triggering the installation process, although in many cases, automated exploitation scripts can target this endpoint directly without user interaction depending on network exposure and existing access controls. The persistence of such a vulnerability allows for long-term unauthorized access, making it a high-priority risk for any production environment running Halo 2.25.4 or earlier versions with similar plugin architectures.
Mitigation strategies must prioritize immediate patching to the latest stable version of Halo where this issue has been resolved by implementing strict validation on URI inputs and restricting dynamic class loading to trusted sources only. Administrators should ensure that the PluginEndpoint is not exposed directly to untrusted networks, ideally placing it behind a reverse proxy with additional request filtering capabilities. Furthermore, running the application with minimal required privileges can limit the blast radius of any successful exploitation attempt. Regular auditing of installed plugins and monitoring for unusual class loading activities in server logs are also recommended defensive measures while updates are being applied.