What is the CVSS score of CVE-2026-55439?

CVE-2026-55439 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-55439?

Yes, a patch is available for CVE-2026-55439. Update the affected software to the latest version immediately.

Halo CMS CVE-2026-55439

EUVD-2026-39465 MEDIUM

Path Traversal (CWE-22)

2026-06-25 GitHub_M

Path Traversal Halo

5.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

5.5 MEDIUM

Admin authentication required (PR:H); network-accessible endpoint (AV:N); read-only filesystem access (I:N); low availability impact from unsanitized backup status fields.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:22 vuln.today

DescriptionCVE.org

Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.

AnalysisAI

Path traversal in Halo's backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem, bypassing directory boundaries. Affected are all Halo deployments prior to version 2.24.3, where the MigrationServiceImpl.download() method invokes Path.resolve() on attacker-supplied filenames without enforcing containment within the designated backups directory. A compounding issue exists in the backup creation endpoint, which fails to sanitize status fields. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement meaningfully constrains the attack surface.

Technical ContextAI

Halo is a Java-based open-source CMS and website building platform (CPE: cpe:2.3:a:halo-dev:halo:*:*:*:*:*:*:*:*). The vulnerability manifests as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in MigrationServiceImpl.download(). The backup download REST endpoint - GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename} - accepts a user-controlled {filename} parameter and passes it directly to Java's Path.resolve() without asserting that the resulting canonical path begins with the expected backups directory prefix. Path.resolve() in Java joins paths and normalizes traversal sequences (e.g., ../../), making it trivially bypassed when the result is not validated. A secondary weakness exists in the POST /apis/migration.halo.run/v1alpha1/backups endpoint, where status fields are accepted during backup creation without sanitization, potentially enabling injection of crafted backup metadata to further influence path resolution.

RemediationAI

Upgrade to Halo 2.24.3, which introduces proper path boundary validation in MigrationServiceImpl.download() and sanitization of status fields in the backup creation endpoint. This is the only confirmed fix per the vendor advisory at https://github.com/halo-dev/halo/security/advisories/GHSA-h8wj-chr2-hf66. For operators unable to upgrade immediately, a compensating control is to restrict network access to the migration API path prefix /apis/console.api.migration.halo.run/ and /apis/migration.halo.run/ via a reverse proxy or WAF, blocking or rate-limiting access to these endpoints for all but a known-safe admin IP range - note this reduces operational convenience for legitimate backup workflows. Additionally, auditing admin account credentials and enforcing MFA on administrator accounts reduces the likelihood of an adversary obtaining the PR:H access required for exploitation. There are no known side effects of upgrading to 2.24.3 beyond the security fix.