CVE-2026-36758

The open-source website building tool Halo version v2.22.14 is vulnerable to a Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint. This flaw allows authenticated attackers to perform internal resource scanning by sending specially crafted GET requests . While the vulner...