Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

halo-dev/halo

              main @ 3e49e00
            

107

Fixes

CVEs

CRITICAL

Peak severity

48.6%

Coverage

Highlights

Auth Bypass: 50 prior fixes. Scrutinize any change in this area.

src/main/java/run/halo/app/security/filter/AbstractAuthenticationFilter.java: most-fixed (5 issues). Treat as high-risk during review.

53 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Bypasses in security filters and endpoints like `/challenges/**` allowed unauthorized requests to bypass Spring Security protections.

Path Traversal: The application historically suffered from Zip Slip and directory traversal during file operations, backups, and theme extraction where paths were not normalized or validated against a safe prefix.

Remote Code Execution: Server-Side Template Injection (SSTI) in FreeMarker was possible because custom configurations lacked restriction on the template class resolver.