Executive brief
Halo, an open-source website builder and content management system, contains a security flaw in its file backup component. An attacker with administrative privileges can exploit this to access or manipulate files outside of the intended backup directory. This could lead to the exposure of sensitive system information or unauthorized changes to the server's file system.
Technical details
A path traversal vulnerability (CWE-22) exists in the MigrationEndpoint.java file of the halo-dev/halo project. The flaw is located within the 'Download' function of the Files Backup Endpoint. A remote attacker with high privileges (PR:H) can provide manipulated input to bypass directory restrictions. This allows for arbitrary file access or manipulation on the underlying server. The vulnerability affects versions up to 2.24.2, and public exploit details have been disclosed.
Affected products
- halo-dev Halo up to 2.24.2
Timeline
- 2026-07-18: disclosed: Vulnerability published via VulDB and NVD