CVE-2026-16088

Name of the Vulnerable Software and Affected Versions halo-dev halo versions prior to 2.24.3

Description A path traversal issue exists in the Files Backup Endpoint component within the Download() function of the MigrationEndpoint.java file. This flaw allows a remote attacker to perform manipulations that enable unauthorized access to files and directories outside the intended folder.

Recommendations Update halo-dev halo to version 2.24.3 or later. As a temporary mitigation, restrict access to the Download() function in the MigrationEndpoint.java file.