Read the docs
TI-2026-40007 Aliases CVE-2026-55439

Halo: Path Traversal in Backup Download Leads to Arbitrary File Read

Priority MEDIUM 58CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed halo (halo-dev): 2.24.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
halo-devhalobefore 2.24.32.24.3Patch availableCNA
  • halo Vendorhalo-dev Affected before 2.24.3 Fixed in 2.24.3 Patch available CNA

Remediation

  • Fix · CNA halo (halo-dev) Fixed in 2.24.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55439

References

Other 2

  • TI-2025-28627 halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in… CVSS 3.1CRITICAL 9.1
  • TI-2025-43155 An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2026-63962 halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization CVSS 4.0MEDIUM 6.9
  • TI-2024-29387 Halo's editor has a stored XSS vulnerability CVSS 3.1MEDIUM 6.4
  • TI-2024-29386 Halo's editor has a stored Cross-Site Scripting vulnerability CVSS 3.1MEDIUM 6.3
  • TI-2022-14503 Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the… CVSS 3.1CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences