Path Traversal Vulnerability in halo-dev's View Name Resolver

CVE-2026-116117

What is CVE-2026-116117?

A security flaw has been discovered in the halo-dev software, specifically within the View Name Resolver component. This vulnerability stems from an improper handling of template arguments in the function DefaultViewNameResolver.resolveViewNameOrDefault. By manipulating these arguments, an attacker could perform a path traversal attack, potentially accessing sensitive files on the server. The vulnerability can be exploited remotely, posing a significant risk. Despite early disclosure attempts, the vendor has not provided a response or remediation strategy for this issue. Users of halo up to version 2.27.0-beta.1 are strongly advised to assess their exposure and take necessary security precautions.

References