CVE-2026-55439

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55439", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T21:59:57.017Z", "datePublished": "2026-06-25T15:57:08.639Z", "dateUpdated": "2026-06-25T18:41:27.946Z"}, "containers": {"cna": {"title": "Halo: Path Traversal in Backup Download Leads to Arbitrary File Read", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66"}, {"name": "https://github.com/halo-dev/halo/issues/10064", "tags": ["x_refsource_MISC"], "url": "https://github.com/halo-dev/halo/issues/10064"}], "affected": [{"vendor": "halo-dev", "product": "halo", "versions": [{"version": "< 2.24.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T15:57:08.639Z"}, "descriptions": [{"lang": "en", "value": "Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3."}], "source": {"advisory": "GHSA-h8wj-chr2-hf66", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/halo-dev/halo/issues/10064", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T18:41:20.038602Z", "id": "CVE-2026-55439", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T18:41:27.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55439", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T18:41:20.038602Z"}}}], "references": [{"url": "https://github.com/halo-dev/halo/issues/10064", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T18:07:25.907Z"}}], "cna": {"title": "Halo: Path Traversal in Backup Download Leads to Arbitrary File Read", "source": {"advisory": "GHSA-h8wj-chr2-hf66", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "halo-dev", "product": "halo", "versions": [{"status": "affected", "version": "< 2.24.3"}]}], "references": [{"url": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66", "name": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/halo-dev/halo/issues/10064", "name": "https://github.com/halo-dev/halo/issues/10064", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-25T15:57:08.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55439", "state": "PUBLISHED", "dateUpdated": "2026-06-25T18:41:27.946Z", "dateReserved": "2026-06-16T21:59:57.017Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-25T15:57:08.639Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "halo", "vendor": "halo-dev", "versions": [{"status": "affected", "version": "< 2.24.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3."}, {"lang": "es", "value": "Halo es una herramienta de c\u00f3digo abierto para la creaci\u00f3n de sitios web. Antes de la 2.24.3, una vulnerabilidad de salto de ruta en el endpoint de descarga de copias de seguridad permite a los administradores autenticados leer archivos arbitrarios del sistema de archivos del servidor. El endpoint de descarga de copias de seguridad (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) en MigrationServiceImpl.download() resuelve el nombre de archivo de la copia de seguridad a trav\u00e9s de Path.resolve() sin validar que la ruta resuelta permanezca dentro del directorio de copias de seguridad designado. Adem\u00e1s, el endpoint de creaci\u00f3n de copias de seguridad (POST /apis/migration.halo.run/v1alpha1/backups) no sanea los campos de estado durante la creaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la 2.24.3."}], "id": "CVE-2026-55439", "lastModified": "2026-10-25T22:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55439", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T18:41:20.038602Z", "version": "2.0.3"}}]}, "published": "2026-06-25T17:16:43.500", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/halo-dev/halo/issues/10064"}, {"source": "security-advisories@github.com", "url": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/halo-dev/halo/issues/10064"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.24.3)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "halo", "source": "cna", "vendor": "halo-dev"}, "product": "halo", "vendor": "halo"}], "created": "2026-06-25T17:45:15.447776+00:00", "updated": "2026-06-26T07:30:05.622099+00:00", "vendors": ["halo", "halo$PRODUCT$halo"]}