CVE-2022-32994: Halo

Critical severity, CVSS 9.8. EPSS: 18.5% chance of exploitation in the next 30 days.

Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.

Affected products

• Halo Halo: version 1.5.3 only

Published 2022-06-27. Last modified 2026-06-17.