CVE-2026-97182

Executive Summary

CVE-2026-97182 is a remote, unauthenticated input validation vulnerability in halo-dev Halo, an open-source Java CMS/blogging platform. The flaw resides in application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java within the SpEL (Spring Expression Language) handler component, where improper neutralization permits attacker-controlled input to reach a SpEL evaluation context. Halo versions up to 2.25.4 and 2.26.1 are affected; a public exploit exists and the vendor has not responded or released a patch, leaving all deployments exposed to potential expression injection leading to information disclosure, data manipulation, or remote code execution depending on SpEL sandboxing.

Technical Analysis

CVE-2026-97182 is classified under CWE-20 (Improper Input Validation). The NVD description identifies the vulnerable file as ReplyNotificationSubscriptionHelper.java within the run.halo.app.content.comment package, and attributes the weakness to the "SpEL Handler" component. The vulnerability is triggered by manipulating input that is processed by a Spring Expression Language (SpEL) evaluation context. SpEL is a powerful expression language in the Spring Framework that, when evaluating untrusted input, can lead to expression injection — a class of vulnerability that permits reading of system properties, invoking methods, and potentially executing arbitrary code via Runtime.exec or ProcessBuilder if not sandboxed.

The attack surface is network-accessible (AV:N) with no authentication (PR:N) and no user interaction (UI:N), as reflected in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The low confidentiality, integrity, and availability scores indicate that the immediate exploit consequences may be limited in scope — possibly constrained by SpEL sandboxing or by the specific data reachable through the ReplyNotificationSubscriptionHelper component. However, because the exploit is publicly disclosed and the component handles reply notification subscriptions (which typically process user-supplied subscription identifiers or email addresses), an attacker could inject SpEL expressions through comment reply notification subscription requests to achieve unauthorized data access or logic manipulation.

The "improper neutralization" language signals that the application fails to sanitize or validate input before SpEL evaluation. In a typical SpEL injection, an attacker submits a string such as ${T(java.lang.Runtime).getRuntime().exec('...')} or #{7*7} to confirm injection. Whether RCE is achievable depends on whether the SpEL evaluation uses a restrictive EvaluationContext (e.g., SimpleEvaluationContext) or the more permissive StandardEvaluationContext. The CVE description does not specify the exact evaluation context or payload syntax, and no public PoC code is available for verification, so the precise exploitation method remains inferred from the vulnerability class.

The vendor was contacted early but did not respond, and no patch confidence exists (0/4) from any tracked source. This means no official fix, workaround, or patched version is available as of the report date.

Exploitation Scenarios

Because no public PoC code or Nuclei template is available, the following attack chain is inferred strictly from the vulnerability class (SpEL injection / improper input validation) and the affected component (reply notification subscription handling).

1. Reconnaissance / Target Identification: An attacker identifies exposed Halo instances via Shodan dorks such as http.title:"Halo" or by fingerprinting the default Halo admin/console paths. The target must be running a vulnerable version (up to 2.25.4 or 2.26.1). Public-facing comment or subscription endpoints are the primary entry points.

2. Triggering the Flaw: The attacker interacts with the comment reply notification subscription functionality — likely by submitting a subscription request (e.g., subscribing to replies on a comment). The ReplyNotificationSubscriptionHelper processes the subscription input and passes it into a SpEL evaluation context without adequate neutralization. The attacker supplies a crafted input string containing SpEL expression delimiters (e.g., ${...} or #{...}).

3. Payload / Execution Method: At the vulnerability-class level, the attacker injects a SpEL expression that is evaluated by the SpEL handler. If the evaluation context is permissive (StandardEvaluationContext), the payload may invoke arbitrary Java methods, read environment variables, access the file system, or execute OS commands. If the context is restrictive, the impact is limited to expression evaluation side effects such as data leakage or logic bypass. No specific payload syntax is confirmed by the available data.

4. Post-Exploitation Impact: Successful exploitation may result in information disclosure (reading configuration files, database credentials, or user data), integrity manipulation (altering notification subscriptions or comment data), or — in the worst case — remote code execution on the Halo server. The CVSS impact subscores (C:L/I:L/A:L) suggest that the immediate, reliable impact is limited, but the public availability of the exploit increases the likelihood of widespread opportunistic scanning and exploitation attempts.

No public PoC is available in this report; the attack chain is inferred from the SpEL injection vulnerability class and the named component. No specific function names, parameters, or endpoints beyond those in the NVD description are asserted.

Impact Assessment

The CVSS 3.1 base score is 7.3 (High), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The high base score is driven by the network attack vector, low attack complexity, and no required privileges or user interaction. The impact subscores are all Low, meaning the immediate compromise may be bounded — but this does not preclude escalation or chained attacks.

Affected systems are any Halo deployments running versions up to 2.25.4 or 2.26.1 that expose comment reply notification subscription functionality to untrusted users. Because Halo is often deployed as a public-facing blog or CMS, the blast radius includes the Halo application server, its database, and any secrets or configuration files accessible to the Halo process. If RCE is achievable, the blast radius extends to the underlying host and potentially internal network resources reachable from the Halo server.

Business impact includes unauthorized access to subscriber data (email addresses, comment content), reputational damage from a public exploit, and potential regulatory exposure if personal data is exfiltrated. The absence of a vendor patch and the public disclosure of the exploit raise the risk of opportunistic exploitation by both scripted scanners and targeted actors. CISA KEV status is NO, and EPSS is not yet scored, so no formal prioritization signal exists beyond the CVSS score and public exploit availability.

Detection Guidance

Sigma Rule

title: Halo SpEL Injection Attempt in Reply Notification Subscription
id: 8f4c2e6a-1b9d-4f7e-a3c5-9d2e6b8f1a4c
status: experimental
description: Detects SpEL expression delimiters in Halo comment reply notification subscription requests
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97182
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026.97182
logsource:
  category: webserver
  product: halo
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_uri:
    cs-uri-stem|contains:
      - '/comment'
      - '/reply'
      - '/subscription'
  selection_payload:
    cs-uri-query|contains:
      - '${'
      - '#{'
      - 'T(java.lang'
      - 'T(java.lang.Runtime)'
      - 'getRuntime'
      - 'ProcessBuilder'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate use of template syntax in comment content
level: high

YARA Rule

rule CVE_2026_97182_Halo_SpEL_Injection
{
    meta:
        description = "Detects SpEL injection payloads targeting Halo ReplyNotificationSubscriptionHelper"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97182"
        cve = "CVE-2026-97182"
    strings:
        $spel1 = "${" ascii wide
        $spel2 = "#{" ascii wide
        $t1 = "T(java.lang.Runtime)" ascii wide
        $t2 = "T(java.lang.ProcessBuilder)" ascii wide
        $t3 = "getRuntime().exec" ascii wide
        $t4 = "ReplyNotificationSubscriptionHelper" ascii wide
        $t5 = "StandardEvaluationContext" ascii wide
    condition:
        uint16(0) == 0xCAFE and
        (
            (any of ($spel1, $spel2) and any of ($t1, $t2, $t3)) or
            ($t4 and any of ($spel1, $spel2)) or
            ($t5 and any of ($t1, $t2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97182 Halo SpEL Injection Attempt in Reply Notification Subscription"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"comment"; http.request_body; content:"${"; http.request_body; content:"T(java.lang"; distance:0; within:100; reference:cve,2026-97182; classtype:web-application-attack; sid:202697182; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and
   stringContains(http.request.uri, "comment") and
   (stringContains(http.request.body, "${") or stringContains(http.request.body, "#{"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=halo
| search (uri_path="*comment*" OR uri_path="*reply*" OR uri_path="*subscription*")
| search (uri_query="*${*" OR uri_query="*#{*" OR form_data="*T(java.lang*" OR form_data="*getRuntime*")
| table _time, src_ip, uri_path, uri_query, form_data, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,halo,cve-2026-97182,">
  <rule id="202697182" level="12">
    <if_sid>31100</if_sid>
    <match>comment|reply|subscription</match>
    <regex>(\$\{|\#\{|T\(java\.lang|getRuntime)</regex>
    <description>CVE-2026-97182 - Halo SpEL injection attempt in reply notification subscription</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Halo comment and subscription endpoints to authenticated users only, if possible.
   • Deploy a Web Application Firewall (WAF) rule to block requests containing SpEL delimiters (${, #{) or Java reflection patterns in comment/subscription parameters.
   • Disable comment reply notification subscription functionality via configuration if it is not operationally required.
   • Monitor logs for exploitation attempts using the detection rules above.

2. Patch/Upgrade Steps:

   • No official patch is available. Monitor the halo-dev Halo GitHub repository and release notes for an advisory or fixed version beyond 2.25.4/2.26.1.
   • Consider applying a community or vendor patch only when a trusted, officially confirmed fix is published.
   • Until a patch is available, isolate affected Halo instances from untrusted networks where feasible.

3. Long-Term Hardening:

   • Ensure all SpEL evaluation uses SimpleEvaluationContext rather than StandardEvaluationContext for any user-influenced input (this is a general Spring hardening best practice, not a confirmed fix for this CVE).
   • Implement strict input validation and allowlisting for subscription/notification identifiers.
   • Adopt a vulnerability management process that tracks unpatched, publicly disclosed CVEs and enforces compensating controls.
   • Maintain network segmentation between public-facing CMS platforms and internal data stores.

References

1. NVD Detail — CVE-2026-97182: https://nvd.nist.gov/vuln/detail/CVE-2026-97182
2. halo-dev Halo Project Repository: https://github.com/halo-dev/halo
3. CWE-20: Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA KEV Catalog (CVE not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog