CVE-2026-15326 Details

A path traversal vulnerability has been identified in the Halo open-source project, specifically in versions through 2.24.2. The issue arises in the ThemeUtils.unzipThemeTo function within ThemeUtils.java, where the argument metadata.name is not properly validated. This lack of validation allows for path traversal attacks, enabling files to be written outside the intended theme directory. The vulnerability can be exploited remotely, and the exploit is publicly available.

It is recommended to validate the metadata.name field in theme.yaml to ensure it does not contain path traversal sequences. Normalize and validate the final target path before copying files to prevent unauthorized access to sensitive directories.