Executive brief
Halo, an open-source website building tool, contains a security flaw in its backup management system. An authorized administrator could exploit this to bypass security restrictions and read sensitive files directly from the server's filesystem. This could lead to the exposure of configuration files, credentials, or other private data, though it does not allow for the modification of files or full system takeover.
Technical details
A path traversal vulnerability (CWE-22) exists in the Halo backup download endpoint `GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}`. The `MigrationServiceImpl.download()` method utilizes `Path.resolve()` on the filename without validating that the resulting path remains within the intended backups directory. An attacker with administrative privileges can first create a Backup resource via a POST request with a manipulated `status.filename` (e.g., `../../../etc/passwd`) and then trigger the download endpoint to retrieve arbitrary files. While Halo contains a `checkDirectoryTraversal()` utility, it was omitted in the download implementation. The issue is resolved in version 2.24.3.
Affected products
- halo-dev Halo < 2.24.3
Timeline
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date
- 2026-06-25: patched: Fix released in version 2.24.3