CVE-2026-15326: Halo-Dev Halo Path Traversal Vulnerability

CVE-2026-15326 Overview

CVE-2026-15326 is a path traversal vulnerability [CWE-22] in halo-dev halo versions up to 2.24.2. The flaw resides in the ThemeUtils.unzipThemeTo function within ThemeUtils.java, part of the Theme Installation component. An attacker with high privileges can manipulate the metadata.name argument to escape the intended extraction directory and write files to arbitrary locations on the filesystem. The attack is remotely exploitable over the network. A public proof-of-concept exists, though the project closed the reporting issue as a duplicate without linking to another tracking record.

Critical Impact
Authenticated attackers can traverse directories during theme installation to write files outside the intended theme directory, potentially affecting integrity and availability of the Halo instance.

Affected Products

halo-dev halo up to and including version 2.24.2
Theme Installation component (ThemeUtils.java)
Function ThemeUtils.unzipThemeTo

Discovery Timeline

2026-07-10 - CVE-2026-15326 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15326

Vulnerability Analysis

Halo is an open-source content management and blogging platform written in Java. The vulnerability affects the theme installation workflow, which accepts a ZIP archive containing theme files and metadata. The unzipThemeTo method in ThemeUtils.java uses the metadata.name field from the theme package as part of the destination path when extracting archive contents.

Because the metadata.name value is not sanitized against directory traversal sequences, an attacker can embed characters such as ../ within the field. When extraction executes, the resulting path resolves outside the intended theme directory. The exploit is publicly available according to the referenced VulDB entry, increasing the likelihood of opportunistic use against unpatched instances.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The unzipThemeTo routine concatenates the attacker-controlled metadata.name value with the theme installation base directory without canonicalizing the final path or verifying it stays within the target root. This is a classic Zip Slip-style flaw applied to a metadata-derived path segment rather than to archive entry names.

Attack Vector

Exploitation requires an authenticated user with permission to install themes, which corresponds to the high privilege requirement in the CVSS vector. The attacker crafts a theme package whose metadata.name contains traversal sequences and uploads it through the Theme Installation interface. When the server processes the archive, files land in locations outside the theme sandbox. Because Halo is typically deployed as a web application, the attack path is network-accessible. Refer to GitHub Issue #10062 and the VulDB CVE-2026-15326 entry for additional technical context.

No verified proof-of-concept code is included here. See the referenced advisories for exploitation details.

Detection Methods for CVE-2026-15326

Indicators of Compromise

Theme packages uploaded to Halo with metadata.name values containing ../, ..\, or absolute path characters.
Unexpected files appearing outside the configured Halo themes directory after a theme installation event.
Modifications to Halo configuration files, static resource directories, or web-accessible paths not tied to legitimate deployments.
Theme installation activity from administrator accounts at unusual times or from unexpected source addresses.

Detection Strategies

Inspect application logs for theme installation requests and correlate them with subsequent file writes outside the themes directory.
Deploy file integrity monitoring on the Halo working directory tree to alert on writes outside expected theme subfolders.
Review uploaded theme archives statically for metadata.name values that contain path separator or traversal sequences before permitting installation.

Monitoring Recommendations

Enable audit logging on privileged Halo accounts and monitor for anomalous theme installation activity.
Forward Halo application logs and host file system events to a centralized SIEM for correlation and alerting.
Baseline the expected contents of the Halo installation directory and alert on deviations after theme operations.

How to Mitigate CVE-2026-15326

Immediate Actions Required

Restrict theme installation permissions to a minimal set of trusted administrator accounts.
Audit existing Halo instances for unauthorized files written outside the themes directory since the last known-good state.
Rotate credentials for any administrator accounts that may have been used to install untrusted themes.
Only install themes from trusted sources and verify archive contents before upload.

Patch Information

At the time of publication, the upstream project closed the tracking issue as a duplicate without referencing another advisory or fix, according to the NVD description. Monitor the Halo GitHub repository and GitHub Issue #10062 for a patched release beyond version 2.24.2 and apply it once available.

Workarounds

Disable the theme upload feature or restrict access to it via reverse proxy access control rules until a patch is deployed.
Run the Halo process under a dedicated low-privilege user account so that writes outside the themes directory fail on filesystem permissions.
Deploy Halo inside a container with a read-only root filesystem and a writable volume scoped only to the themes directory.
Validate theme archives with an out-of-band tool that rejects any metadata.name value containing path separators or traversal sequences.

bash

# Example: run Halo as an unprivileged user with a restricted writable path
useradd -r -s /sbin/nologin halo
chown -R halo:halo /opt/halo/themes
chmod 750 /opt/halo/themes
# Ensure the parent application directory is not writable by the halo user
chown root:root /opt/halo && chmod 755 /opt/halo