CVE-2026-55439: Halo Path Traversal in Backup Download Endpoint (CVSS 5.5)

Technical summary

CVE-2026-55439 is a path traversal vulnerability in Halo's MigrationServiceImpl.download() method. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) uses Path.resolve() to construct file paths without validating that the resolved path remains within the designated backups directory. This allows an authenticated administrator to traverse the filesystem hierarchy using path manipulation techniques (e.g., ../sequences) to read arbitrary files. A secondary issue exists in the backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups), where status fields are not sanitized during backup object creation, potentially allowing data injection or corruption. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Business impact

This vulnerability poses a confidentiality and integrity risk for organizations running Halo instances. Compromised administrators—or administrators whose credentials are stolen—can extract sensitive server-side files such as configuration files, private keys, database credentials, or application source code. While the attack requires authenticated administrator access, the scope is broad: any administrator can access any file readable by the Halo application process. For SaaS providers or multi-tenant deployments, this could expose data across multiple customer instances. The secondary sanitization flaw could be chained with the path traversal to inject malicious backup metadata.

Affected systems

Halo versions prior to 2.24.3 are affected. The vulnerability requires administrator privileges to trigger, so impact is limited to environments where administrator accounts are accessible or compromised. All deployment models—self-hosted, containerized, or cloud-based—are vulnerable if running an affected version.

Exploitability

Exploitation requires valid administrator credentials and network access to the Halo console API. No user interaction or special conditions are needed beyond authentication. The attack is straightforward: an attacker with admin access sends a crafted GET request to the backup download endpoint with a malicious filename parameter containing path traversal sequences. The lack of path validation makes successful exploitation highly reliable. The CVSS score of 5.5 (Medium) reflects the requirement for high-privilege authentication (PR:H), though the impact on confidentiality is rated as High (C:H). This vulnerability is not currently listed in the CISA KEV catalog.

Remediation

Upgrade Halo to version 2.24.3 or later, which implements proper path validation in the backup download endpoint. The fix ensures that resolved file paths remain within the designated backups directory before file access. Additionally, sanitization has been added to the backup creation endpoint status fields. Organizations unable to patch immediately should restrict administrator access to only trusted personnel and monitor backup download requests for anomalous filename parameters.

Patch guidance

Apply version 2.24.3 or later. Verify the patched version is in effect by checking the application version endpoint or reviewing release notes at the Halo project repository. If Halo is deployed via container, update the container image tag to 2.24.3+. If deployed via source, pull the latest stable branch and rebuild. Test the upgrade in a non-production environment first to ensure compatibility with existing backups and configurations.

Detection guidance

Monitor web server access logs for requests to the /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/ endpoint containing suspicious filename parameters, such as those with ../ sequences or absolute paths. Examine application logs for backup download operations initiated by unexpected administrator accounts or at unusual times. Check file access logs on the server to identify whether arbitrary files outside the backups directory have been read by the Halo process. Network intrusion detection signatures may alert on HTTP requests containing path traversal patterns in query or URL parameters.

Why prioritize this

Although the CVSS score is Medium and the attack requires administrator privileges, the issue should be prioritized because (1) confidentiality impact is rated High—sensitive files can be fully read, (2) the exploit is trivial once an admin account is compromised or misused, (3) organizations may not have granular audit trails for administrator actions, and (4) the vulnerability is easily exploitable with simple HTTP requests. For high-security environments or those managing sensitive data, this warrants rapid patching even if administrator access is tightly controlled.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), and high privilege requirement (PR:H). High confidentiality impact (C:H) acknowledges that arbitrary file read is possible. Low availability impact (A:L) accounts for potential denial of service through resource exhaustion during large file transfers. Integrity impact is none (I:N) because the path traversal itself does not modify files, though the secondary sanitization flaw raises integrity concerns. The Medium severity appropriately balances the broad file-read capability against the authentication barrier.

Frequently asked questions