Cpe:2.3:a:halo_dev:halo:*:*:*:*:*:*:*:*

A path traversal vulnerability exists in the halo-dev halo View Name Resolver component (up to 2.27.0-beta.1) via the template argument.

Halo versions 2.25.4/2.26.1 and prior contain a critical vulnerability in the SpEL Handler component, allowing remote unauthenticated attackers to achieve remote code execution through improper expression neutralization.