https://feed.craftedsignal.io/products/halo-up-to-2.27.0-beta.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 05:34:52 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-halo-path-traversal/Mon, 26 Oct 2026 05:34:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-halo-path-traversal/A path traversal vulnerability exists in the halo-dev halo View Name Resolver component (up to 2.27.0-beta.1) via the template argument.A flaw has been identified in halo-dev halo up to 2.27.0-beta.1, specifically within the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault. Manipulation of the template argument can lead to path traversal. The attack can be launched remotely. Exploit code has been published. The vendor did not respond to disclosure.

]]>highadvisory