Server-Side Request Forgery in Halo by Halo Dev
CVE-2026-36758

4.3MEDIUM

Key Information:

Vendor

Halo Dev

Status
Halo
Vendor
CVE Published:
30 April 2026

What is CVE-2026-36758?

A vulnerability exists in Halo v2.22.14 that enables authenticated users to exploit the /themes/-/install-from-uri endpoint, allowing them to send specially crafted GET requests. This could potentially grant access to sensitive internal resources, raising significant security concerns for systems relying on this version of Halo.

References

https://github.com/halo-dev/halo
https://github.com/Arron-bit/Vul_report/blob/main/halo/ss...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.