CVE-2026-67919

creationtimestamp| type| source ---|---|--- 2026-08-18 13:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtebistfd32e 2026-08-20 03:00:04+00:00| published-proof-of-concept| Telegram/OEj0lkcuhy0tneu4LVEJjjSEMhrw6Me4lFPRcwL7UUOA 2026-08-20 03:00:04+00:00|...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

CVE-2026-67919

Halo version 2.25.4 is vulnerable to Remote Code Execution (RCE) due to unvalidated plugin URI installations. The application fails to validate the source domain of the URI and lacks SSRF protections on the plugin management endpoint. An authenticated attacker with plugin management privileges ca...