Halo CMS EUVD-2026-109609

Exploitation requires reaching Halo's theme view-name resolution logic with an attacker-influenced 'template' argument, which DefaultViewNameResolver.resolveViewNameOrDefault then resolves; the CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed and the attack is remote. The precise request/endpoint that supplies the 'template' value is not described in the available sources. Limiting factors: impact is rated Low across confidentiality, integrity and availability by the reporter (consistent with constrained file access rather than full read of arbitrary paths or code execution), affected scope is Halo builds up to 2.27.0-beta.1, and exploit maturity is only Proof-of-Concept (E:P).

This is a moderate-severity path traversal (CWE-22) in the Halo CMS theme View Name Resolver, carrying a CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N and limited impact across all three dimensions (VC:L/VI:L/VA:L, no subsequent-system impact). The network-reachable, low-complexity, no-privilege, no-interaction profile means the barrier to attempt is low. However, the real-world priority is tempered: the CVSS 4.0 exploit-maturity metric is E:P (Proof-of-Concept), the only reporter is VulDB, and vuln.today assigns a 'this_month' decision label rather than an immediate/act_now urgency. The description states an exploit has been published, so this should be treated as having a public PoC reference. There is NO CISA KEV listing and NO EPSS score in the supplied data, so widespread or confirmed active exploitation cannot be asserted - exploitation status here is proof-of-concept only, not in-the-wild. The impact ceiling is modest (all impacts rated Low by the reporter), consistent with a file-disclosure/path-traversal primitive rather than code execution. Net: a genuine, remotely reachable issue worth patching on a normal (monthly) cycle, not a drop-everything emergency, and the limited-impact rating plus single-source reporting argue against over-prioritizing it on raw reachability alone.

A remote attacker sends an HTTP request to a Halo instance that reaches the theme view-name resolution path and supplies a crafted value for the 'template' argument containing path-traversal sequences. Because DefaultViewNameResolver.resolveViewNameOrDefault does not adequately constrain the template name, the attacker can direct resolution outside the intended theme directory. A public PoC reference exists (CVSS exploit maturity E:P, exploit reported as published by VulDB); it is not verified as working exploit code in the supplied data.