high
advisory
Halo: Path traversal in View Name Resolver (CVE-2026-116117)
A path traversal vulnerability exists in the halo-dev halo View Name Resolver component (up to 2.27.0-beta.1) via the template argument.
CVE search metadata
CVE search record: CVE-2026-116117. Severity: high. CVSS: 7.3. KEV: no. Product: halo (up to 2.27.0-beta.1). Brief: Halo: Path traversal in View Name Resolver (CVE-2026-116117). Brief link: https://feed.craftedsignal.io/briefs/2026-10-halo-path-traversal/
Triage facts
Revision 1- Applicability
- halo (up to 2.27.0-beta.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 05:34 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A flaw has been identified in halo-dev halo up to 2.27.0-beta.1, specifically within the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault. Manipulation of the template argument can lead to path traversal. The attack can be launched remotely. Exploit code has been published. The vendor did not respond to disclosure.