Server-Side Request Forgery in Halo Application by Halo Dev
CVE-2026-36757

4.3MEDIUM

Key Information:

Vendor

Halo Dev

Status
Halo
Vendor
CVE Published:
30 April 2026

What is CVE-2026-36757?

A vulnerability exists in the Halo application version 2.22.14 that enables authenticated attackers to execute Server-Side Request Forgery (SSRF) attacks via the /plugins/{name}/upgrade-from-uri endpoint. By crafting a GET request, attackers can potentially access and scan internal resources, raising significant security concerns for affected systems.

References

https://github.com/halo-dev/halo
https://github.com/Arron-bit/Vul_report/blob/main/halo/ss...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.