CVE-2026-67919

Halo 2.25.4 is vulnerable to remote arbitrary code execution through the installFromUri method in PluginEndpoint.java and DefaultPluginApplicationContextFactory. A remote attacker can supply a malicious plugin URI to install and execute arbitrary code. No patch version, root cause analysis, or ex...