CVE-2026-55439

{
  "id": "CVE-2026-55439",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-25T17:16:43.500",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3."
    },
    {
      "lang": "es",
      "value": "Halo es una herramienta de código abierto para la creación de sitios web. Antes de la 2.24.3, una vulnerabilidad de salto de ruta en el endpoint de descarga de copias de seguridad permite a los administradores autenticados leer archivos arbitrarios del sistema de archivos del servidor. El endpoint de descarga de copias de seguridad (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) en MigrationServiceImpl.download() resuelve el nombre de archivo de la copia de seguridad a través de Path.resolve() sin validar que la ruta resuelta permanezca dentro del directorio de copias de seguridad designado. Además, el endpoint de creación de copias de seguridad (POST /apis/migration.halo.run/v1alpha1/backups) no sanea los campos de estado durante la creación. Esta vulnerabilidad está corregida en la 2.24.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "halo-dev",
          "product": "halo",
          "versions": [
            {
              "version": "< 2.24.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T18:41:20.038602Z",
          "id": "CVE-2026-55439",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/halo-dev/halo/issues/10064",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/halo-dev/halo/issues/10064",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}