CVE-2026-67919

creationtimestamp| type| source ---|---|--- 2026-08-18 13:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtebistfd32e 2026-08-20 03:00:04+00:00| published-proof-of-concept| Telegram/OEj0lkcuhy0tneu4LVEJjjSEMhrw6Me4lFPRcwL7UUOA 2026-08-20 03:00:04+00:00|...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

CVE-2026-67919

Halo (open-source CMS) version 2.25.4 is vulnerable to remote code execution via the installFromUri method in PluginEndpoint.java and DefaultPluginApplicationContextFactory. The plugin installation endpoint fetches an arbitrary URL without scheme or host validation, downloads the JAR, and loads i...