Halo EUVD-2026-85859

Requires a network-reachable Halo instance (version up to 2.25.4/2.26.1) with the comment/reply-notification subscription functionality active - the default configuration of a public-facing Halo blog. No authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) per the CVSS 4.0 vector, so a default internet-exposed deployment is exploitable. Limiting factors: exploitation is bounded to the ReplyNotificationSubscriptionHelper SpEL handler code path (commenting/subscription must be enabled), and no vendor patch exists, so mitigation currently depends on restricting comment functionality or WAF filtering. Impact is rated low across C/I/A, limiting realistic damage relative to a full SpEL RCE.

This is a genuine but modest-severity issue. VulDB's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, score 6.9) describes an unauthenticated, network-reachable, low-complexity flaw with balanced but LOW technical impact across confidentiality, integrity, and availability - the SSVC/4.0 exploit-maturity metric E:P confirms proof-of-concept code exists but not active exploitation. There is NO EPSS score, NO CISA KEV listing, and no evidence of in-the-wild use, so this should be treated as a disclosed-with-POC issue rather than a mass-exploitation priority. A notable tension: the affected component is a 'SpEL Handler' (Spring Expression Language), which in the worst case can enable expression-injection leading to RCE, yet the assigned impacts are capped at :L each - meaning either the injection is constrained (limited/sandboxed expression context) or VulDB assessed it conservatively. Verify with the vendor/POC whether this is truly low-impact SpEL neutralization or an under-scored RCE primitive. Also weigh that the sole exploit reference is a third-party writeup and VulDB, with NO vendor advisory and NO patch (vendor did not respond), so severity details are single-sourced and unconfirmed.

A remote, unauthenticated attacker submits a crafted comment/reply-notification subscription to a public Halo blog, injecting content that the ReplyNotificationSubscriptionHelper's SpEL handler improperly neutralizes when building notification data. Publicly available POC (linked via VulDB and a third-party writeup) demonstrates triggering the improper-neutralization flaw over the network, resulting in limited disclosure/tampering. Because AC:L/PR:N/UI:N, the trigger is a straightforward request against a default, internet-facing Halo instance.