CVE-2026-15326: Halo Path Traversal in Theme Installation (CWE-22)

Technical summary

The vulnerability exists in the ThemeUtils.unzipThemeTo method within ThemeUtils.java. The component processes theme installation archives but fails to properly validate the metadata.name argument before using it in file path operations. An attacker with administrative credentials can inject path traversal sequences (such as ../) to escape the intended extraction directory. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Public exploit code exists, though exploitation requires high-privilege authentication. The vendor closed the issue as a duplicate without referencing or linking to any related CVE or security report.

Business impact

The practical risk is limited by the requirement for high-privilege (administrative) access. However, a compromised or malicious admin account could use this to corrupt application files, inject backdoors, or degrade system stability by overwriting critical files. Organizations relying on role-based access control and admin account security may face a lower immediate threat; however, those with excessive privilege delegation or weak admin credential management should assess exposure. The low CVSS score reflects the high barrier to exploitation (PR:H) but should not lead to dismissal if your threat model includes insider threats or credential compromise at the admin tier.

Affected systems

Halo version 2.24.2 and earlier are affected. The specific component is the theme installation feature. No vendor or product information was published in the source data; verify the exact scope and any patched versions against the official Halo project advisory or GitHub repository.

Exploitability

Exploitation requires valid administrative credentials and direct access to the theme installation interface. No unauthenticated attack path exists. Public proof-of-concept code is available, reducing the technical barrier once an attacker gains admin access, but the authentication gate remains a significant control. Attack complexity is low once credentials are obtained.

Remediation

Update Halo to a version containing the path traversal fix. Since the vendor closed this as a duplicate without providing a linked issue or alternative CVE identifier, verify the current stable release on the official Halo repository and confirm whether patches are available. Organizations should also enforce strict admin credential management, role separation, and monitoring of theme installation activities.

Patch guidance

Check the official Halo project releases (GitHub or documentation) for versions beyond 2.24.2 that address this path traversal issue. The vendor has not published explicit patch version guidance in the available data; contact Halo maintainers or review security advisories for the specific fix version. Apply patches during a maintenance window after validating compatibility in a staging environment.

Detection guidance

Monitor admin accounts for unusual theme installation activity, particularly those involving multiple or rapid uploads. Log and alert on file writes outside the standard theme directory during theme installation operations. Inspect theme metadata and archive contents for path traversal patterns (../, ..\ sequences) before extraction. Consider implementing file integrity monitoring on critical application directories to detect unauthorized modifications.

Why prioritize this

Despite a low CVSS score (3.8), this vulnerability should be tracked because: (1) public exploits are available; (2) it affects file system integrity; (3) insider threat or credential compromise scenarios could trigger real damage; and (4) the vendor's lack of transparency on the duplicate issue creates uncertainty around remediation status. Prioritize patching if you operate Halo with untrusted or high-risk admin populations, or if admin credentials have been compromised in the past.

Risk score, explained

The CVSS 3.1 score of 3.8 (LOW severity) reflects a network-accessible vulnerability with low attack complexity, but high privilege requirements and no confidentiality impact. Integrity and availability impact are limited to one level each. The score appropriately captures the authentication barrier; however, organizations should layer this with their own threat modeling—particularly regarding insider threats, credential compromise patterns, and the criticality of the affected Halo instance.

Frequently asked questions