CVE-2021-43659

5.4 mediumEPSS 0.6%

Medium (5.4) in halo halo. EPSS 0.6% chance of exploitation in the next 30 days.

In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-03-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

halo:halo

References

https://github.com/halo-dev/halo/issues/1522
https://github.com/halo-dev/halo/issues/1522

Check your stack JSON