CVE-2026-67919: Halo CMS RCE Vulnerability

CVE-2026-67919 Overview

CVE-2026-67919 is a remote code execution vulnerability in Halo 2.25.4, an open-source content management system. The flaw resides in the PluginEndpoint.java component, specifically the installFromUri method, and interacts with the DefaultPluginApplicationContextFactory. A remote attacker can leverage these components to execute arbitrary code on affected instances. The issue is categorized as code injection [CWE-94] and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on Halo 2.25.4 servers, leading to full system compromise, data theft, and lateral movement.

Affected Products

Halo 2.25.4 (open-source CMS by halo-dev)
PluginEndpoint.java component
DefaultPluginApplicationContextFactory component

Discovery Timeline

2026-08-17 - CVE-2026-67919 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-67919

Vulnerability Analysis

The vulnerability affects Halo 2.25.4, a Java-based open-source content management platform. The installFromUri method within PluginEndpoint.java accepts a remote URI and installs the referenced plugin without adequate validation. When the DefaultPluginApplicationContextFactory loads the retrieved plugin, attacker-controlled code executes within the Halo application context.

Because the endpoint is reachable over the network and requires no privileges, attackers can trigger the flaw with a single HTTP request pointing to a malicious plugin package. Successful exploitation yields arbitrary code execution under the privileges of the Halo process.

Root Cause

The root cause is improper control of code generation [CWE-94]. The installFromUri method treats the supplied URI as a trusted source for executable plugin content. Halo does not validate the origin, signature, or contents of the retrieved artifact before the plugin factory instantiates its classes, allowing injected code to run at load time.

Attack Vector

Exploitation follows a network-based path. An attacker hosts a crafted plugin archive on an attacker-controlled server, then issues a request to the vulnerable installFromUri endpoint referencing that URL. Halo downloads the archive and passes it to DefaultPluginApplicationContextFactory, which loads and executes the embedded code. See the GitHub Gist PoC Code and the GitHub Halo Project Overview for additional context. No verified sanitized exploit code is reproduced here.

Detection Methods for CVE-2026-67919

Indicators of Compromise

Inbound HTTP requests to the Halo plugin management endpoint referencing installFromUri with external URIs.
Outbound HTTP or HTTPS connections from the Halo host to previously unseen domains hosting .jar or plugin archives.
New or unexpected plugin directories, JAR files, or classes appearing under the Halo plugin storage path.
Unusual child processes spawned by the Halo Java process, such as shells or network utilities.

Detection Strategies

Monitor web access logs for POST requests targeting plugin installation APIs with URI parameters pointing to untrusted hosts.
Alert on file writes to the Halo plugin directory that do not originate from an administrative session or approved deployment pipeline.
Correlate plugin installation events with subsequent outbound network activity or process creation on the Halo server.

Monitoring Recommendations

Enable verbose application logging for the PluginEndpoint controller and forward logs to a centralized analytics platform.
Baseline normal plugin installation behavior and alert on deviations, particularly requests from non-administrative IP ranges.
Track Java process behavior on Halo hosts, including class loading from unexpected paths and network egress patterns.

How to Mitigate CVE-2026-67919

Immediate Actions Required

Restrict network access to the Halo administration and plugin management endpoints using firewall rules or reverse proxy allowlists.
Disable plugin installation from remote URIs where operationally feasible until a patched release is deployed.
Rotate administrative credentials and API tokens if the Halo instance was exposed to the internet.
Review Halo plugin directories and application logs for signs of unauthorized plugin installation.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Halo project repository for security releases and upgrade beyond 2.25.4 once a patched version becomes available.

Workarounds

Place Halo behind an authenticated reverse proxy and block direct internet exposure of the admin API.
Enforce egress filtering on the Halo server so it cannot fetch arbitrary remote URIs.
Run Halo under a least-privilege service account within a container or sandbox to limit blast radius if code execution occurs.
Remove or disable the plugin installation endpoint at the reverse proxy layer if plugins are not actively managed.

bash

# Configuration example: block the plugin install endpoint at an nginx reverse proxy
location ~* /apis/api\.console\.halo\.run/.*/plugins/install-from-uri {
    deny all;
    return 403;
}