What’s Vulnerable › Vulnerabilities

CVE-2019-19999

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-26 · updated 2026-06-17
• Weakness: CWE-918

Description

Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.

Affected products

• halo-dev halo: through 1.1.1; 1.1.3-beta1, 1.1.3-beta2, 1.2.0-beta1

References

• https://github.com/halo-dev/halo/compare/v1.1.3-beta.2...v1.2.0-beta.1
• https://github.com/halo-dev/halo/issues/419
• https://github.com/halo-dev/halo/issues/440
• https://github.com/halo-dev/halo/compare/v1.1.3-beta.2...v1.2.0-beta.1
• https://github.com/halo-dev/halo/issues/419
• https://github.com/halo-dev/halo/issues/440

Get alerted when CVE-2019-19999 or the next vulnerability affects your stack