CVE-2026-55439 Halo: Path Traversal in Backup Download Leads to Arbitrary File Read
Authenticated administrators can read arbitrary files from the server filesystem via a path traversal vulnerability in the backup download endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55439?
CVE-2026-55439 is a medium-severity path traversal vulnerability in halo-dev halo, published on 25 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-55439?
How do I fix CVE-2026-55439?
No fix has been published for CVE-2026-55439 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55439 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55439 exists.