CVE-2026-67919 | Halo 2.25.4 DefaultPluginApplicationContextFactory PluginEndpoint.java installFromUri code injection

A vulnerability was found in Halo 2.25.4. It has been classified as critical. This vulnerability affects the function installFromUri of the file PluginEndpoint.java of the component DefaultPluginApplicationContextFactory. Performing a manipulation results in code injection.

This vulnerability is known as CVE-2026-67919. Remote exploitation of the attack is possible. No exploit is available.