CVE-2020-21523

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: <#assign test="freemarker.template.utility.Execute"?new()> ${test("touch /tmp/freemarkerPwned")}

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/halo-dev/halo/issues/419Exploit, Issue Tracking, Third Party Advisory
https://github.com/halo-dev/halo/issues/419Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Sep 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-215249.1There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrat CVE-2020-215257.5Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performe CVE-2020-215269.8An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory traversal check is per CVE-2020-215277.7There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their bac CVE-2020-215285.5A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a d CVE-2020-215295.5fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.CVE-2020-21534.3Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially result CVE-2020-215305.5fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.CVE-2020-215315.5fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.CVE-2020-215325.5fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.CVE-2020-215335.5fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c.CVE-2020-215345.5fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c.