CVE-2026-15326

Publié : 10 juillet 2026

Modifié : 10 juillet 2026

Score CVSS

3.8

LOW

Description détaillée

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Références et Patchs

https://github.com/halo-dev/halo/https://github.com/halo-dev/halo/issues/10062 https://vuldb.com/cve/CVE-2026-15326 https://vuldb.com/submit/853064 https://vuldb.com/vuln/377265 https://vuldb.com/vuln/377265/cti

Dernières Vulnérabilités

CVE-2026-21057

Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.

VOIR DÉTAILS

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.

VOIR DÉTAILS

CVE-2026-21055

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

VOIR DÉTAILS