CVE-2026-55439
Description
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.
Summary dbcve.org
A path traversal vulnerability in Halo CMS allows authenticated administrators to read arbitrary files via the backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}). The MigrationServiceImpl.download() method uses Path.resolve() without validating that the resolved path remains within the designated backups directory, enabling directory traversal attacks.
Mitigation
Upgrade to Halo version 2.24.3 or later, which includes proper path validation in the backup download endpoint and sanitization of status fields during backup creation.