CVE-2026-67920 Overview
CVE-2026-67920 is a high-severity vulnerability in Halo 2.25.4, an open-source content management system. The flaw resides in the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir() method and the org.springframework.util.FileSystemUtils.copyRecursively() component. Authenticated remote attackers can leverage the migration restore functionality to execute arbitrary code on the host. The issue is classified under [CWE-73]: External Control of File Name or Path. Successful exploitation compromises confidentiality, integrity, and availability of the affected Halo instance.
Critical Impact
A low-privileged authenticated attacker can achieve arbitrary code execution on the underlying server through crafted migration archives processed by the restore workflow.
Affected Products
- Halo 2.25.4
- Halo instances relying on MigrationServiceImpl.restoreWorkdir()
- Deployments using FileSystemUtils.copyRecursively() during restore operations
Discovery Timeline
- 2026-08-18 - CVE-2026-67920 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-67920
Vulnerability Analysis
Halo exposes a migration feature that allows administrators to restore a previously exported workdir archive. The MigrationServiceImpl.restoreWorkdir() method processes uploaded archive contents and writes files to the working directory using Spring's FileSystemUtils.copyRecursively(). Because the archive entries are not validated against a restricted base path, attackers can supply crafted paths that escape the intended destination. Writing controlled files outside the workdir enables replacement of application resources, templates, or plugin artifacts, which the Halo runtime later loads and executes.
Root Cause
The root cause is external control of file names and paths during archive extraction, corresponding to [CWE-73]. Neither restoreWorkdir() nor the underlying copyRecursively() invocation enforces path canonicalization or a whitelist of allowed destinations. Archive entries carrying traversal sequences or absolute paths are copied verbatim to attacker-chosen locations on disk.
Attack Vector
Exploitation requires network access and low-privileged authenticated access to the Halo administration interface. The attacker uploads a malicious migration archive through the restore endpoint. During processing, files land in locations that Halo or its plugin loader will later execute, producing arbitrary code execution in the context of the Halo process. The attack completes without user interaction beyond the attacker's own authenticated session.
The vulnerability manifests during archive processing in the migration restore workflow. See the GitHub Gist proof of concept and Halo Pull Request #4206 for technical details.
Detection Methods for CVE-2026-67920
Indicators of Compromise
- Unexpected files written outside the Halo workdir following calls to the migration restore endpoint.
- Archive uploads to /apis/api.console.halo.run/v1alpha1/migrations/restoration from non-administrative sources or unusual IP addresses.
- New or modified JAR, template, or plugin files with modification timestamps aligned with restore activity.
- Halo application processes spawning shell interpreters or outbound connections shortly after a restore operation.
Detection Strategies
- Audit Halo access logs for POST requests to migration and restoration endpoints, correlating with the authenticated user identity.
- Monitor filesystem changes on the Halo host, particularly writes to directories outside the configured workdir.
- Inspect uploaded archives for entries containing .. sequences or absolute path prefixes prior to processing.
Monitoring Recommendations
- Enable file integrity monitoring on Halo installation directories, plugin folders, and theme paths.
- Alert on child processes spawned by the Halo Java process that deviate from baseline behavior.
- Retain and centralize Halo application and web server logs for correlation with restore activity.
How to Mitigate CVE-2026-67920
Immediate Actions Required
- Restrict access to the Halo administration console and migration endpoints to trusted operators only.
- Rotate administrator credentials and API tokens that could be used to reach the restore functionality.
- Disable or gate the migration restore feature behind network controls until a fixed release is deployed.
- Review recent restore activity and validate the integrity of files in the Halo workdir and plugin directories.
Patch Information
Track the upstream fix in the Halo GitHub repository and the associated Pull Request #4206. Upgrade to a Halo release that incorporates path validation in MigrationServiceImpl.restoreWorkdir() and constrains FileSystemUtils.copyRecursively() to the intended destination directory.
Workarounds
- Place the Halo administration interface behind a VPN or IP allowlist to reduce exposure.
- Enforce multi-factor authentication for all administrative accounts capable of triggering restores.
- Run Halo as a non-privileged user with a restrictive filesystem policy that limits write access outside the workdir.
- Validate migration archives in an isolated environment before applying them to production instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
