Is there a public PoC exploit available for CVE-2026-15326?

Yes, a public proof-of-concept exploit is available for CVE-2026-15326. Prioritise patching immediately. EPSS: 0.4%.

Halo CMS CVE-2026-15326

Q: What is the CVSS score of CVE-2026-15326?

CVE-2026-15326 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42782 LOW

Path Traversal (CWE-22)

2026-07-10 VulDB

GHSA-9p22-639x-ghp4

Java Path Traversal Halo

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

Theme installation is admin-only (PR:H); impact limited to partial file write (I:L) and minor disruption (A:L) with no confidentiality exposure (C:N).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 04:26 vuln.today

Severity Changed

Jul 10, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 04:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.

AnalysisAI

Path traversal in halo-dev/halo through version 2.24.2 allows authenticated administrators to write files outside the intended theme directory by supplying a crafted metadata.name value during theme installation. The flaw resides in the ThemeUtils.unzipThemeTo() function in ThemeUtils.java, which fails to sanitize the metadata name before constructing extraction paths. A public proof-of-concept exploit exists, but real-world impact is substantially constrained by the PR:H prerequisite - the attacker must already hold admin-level credentials - yielding a CVSS 4.0 score of only 2.0 and no CISA KEV listing.

Technical ContextAI

Halo is an open-source Java-based blogging and CMS platform maintained by halo-dev. The vulnerability is rooted in CWE-22 (Path Traversal): the ThemeUtils.unzipThemeTo() method in ThemeUtils.java processes theme ZIP archives without validating or canonicalizing the metadata.name field before using it to assemble output file paths. An attacker can embed directory traversal sequences (e.g., ../../) in a crafted theme package's metadata, causing the extraction routine to write files to arbitrary filesystem locations accessible under the Halo process account. The CPE string cpe:2.3:a:halo-dev:halo:*:*:*:*:*:*:*:* applies to all versions through 2.24.2 with no platform restriction.

RemediationAI

No vendor-released patch has been confirmed at time of analysis - the GitHub issue (https://github.com/halo-dev/halo/issues/10062) was closed as a 'duplicate' with no reference to a fix, alternative CVE, or patched release. Administrators should monitor the project repository at https://github.com/halo-dev/halo for an official security release. As a compensating control, limit theme installation permissions to the absolute minimum set of trusted administrator accounts, reducing the pool of principals who can trigger the vulnerable code path. Additionally, run the Halo process under a least-privilege operating system account to contain the blast radius of any successful path traversal - this limits which filesystem paths an attacker could reach even if exploitation occurs. Be aware that restricting the OS account may affect legitimate Halo write operations if not scoped carefully.