An arbitrary file upload vulnerability in Halo up to v1.6.1 allows malicious users to execute arbitrary code via a crafted .md file.
halo halo