Skip to content
Threat Feed
Subscribe

Product

Halo

1 brief RSS
critical advisory

Remote Code Execution in Halo via Plugin and Migration Vulnerabilities

Halo versions up to 2.25.4 are vulnerable to RCE through insecure plugin installation and migration restoration processes, which can be chained with CSRF to allow unauthenticated attackers to compromise an instance if an administrator visits a malicious page.

Halo
1r 2t 3c