Halo CMS CVE-2026-16088

Q: What is the CVSS score of CVE-2026-16088?

CVE-2026-16088 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45369 LOW

Path Traversal (CWE-22)

2026-07-18 cna@vuldb.com

GHSA-mrpc-g9pq-2433

Java Path Traversal

2.0

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

Network-reachable endpoint (AV:N), low complexity, but admin authentication required (PR:H); path traversal yields limited file read/write, no availability or scope impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 10:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

Path traversal in Halo CMS up to version 2.24.2 allows a remotely authenticated high-privilege user to access files outside the intended backup directory via the Download function of MigrationEndpoint.java in the Files Backup Endpoint. The vulnerability is CWE-22 (Improper Limitation of a Pathname) and carries a low CVSS score of 2.0 due to the PR:H requirement, meaning exploitation is limited to users who already hold administrator-level access. A public proof-of-concept exploit exists per the provided references, though no CISA KEV listing was found at time of analysis.

Technical ContextAI

Halo is an open-source Java-based blogging and content management platform maintained by halo-dev. The affected component is MigrationEndpoint.java, which exposes a file backup and migration API endpoint. The Download function in this endpoint fails to properly sanitize or canonicalize user-supplied file path parameters, a classic CWE-22 path traversal root cause. An attacker who can supply a manipulated path such as '../../etc/passwd' can cause the server to resolve and serve files outside the intended backup storage directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) confirms this is a network-reachable endpoint with no attack prerequisites beyond high-privilege authentication. The Java tag in the intelligence data confirms the platform runtime, and the GitHub issue tracker reference (issue #10064) is the primary disclosure channel.

RemediationAI

The primary remediation is to upgrade Halo CMS beyond version 2.24.2 once a patched release is published by halo-dev; no exact fix version was confirmed in the available reference data - monitor the GitHub repository (https://github.com/halo-dev/halo/) and issue #10064 for the official patch release. In the interim, administrators should restrict access to the MigrationEndpoint backup download API to trusted IP ranges or internal networks only, reducing the network-accessible attack surface even for authenticated users. Disabling or removing access to the Files Backup Endpoint entirely is a viable compensating control if backup functionality is not in active use, though this will break legitimate migration workflows. Audit admin account access and enforce multi-factor authentication on all administrator accounts to raise the bar for exploitation, since PR:H is the primary limiting factor. No vendor advisory URL with a specific fixed version was available at time of analysis.