CVE-2026-55439
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Halo is an open source website building tool. Prior to version 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data on the server, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to version 2.24.3 or later to mitigate this vulnerability and ensure proper validation and sanitization of data in the endpoints.
Other vulnerabilities in Halo
See all- CVE-2026-67919Critical
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components.
- CVE-2026-67920High
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components.
- CVE-2026-15326Low
A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the ThemeUtils.unzipThemeTo function of ThemeUtils.java during theme installation. Manipulating the metadata.name argument allows remote exploitation, and a public exploit is available.
- CVE-2025-51857Medium
An XSS vulnerability in the reconcile method of the AttachmentReconciler class in Halo system v.2.20.18LTS and earlier allows an attacker to inject malicious scripts.
- CVE-2023-27164Medium
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
Original NVD description (English source)
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.