6.1Medium

CVE-2025-44593

halo halo Published: 2025-09-09 03:00 (1 year ago)

Description

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
halo	halo	< 2.20.13

References and patches

https://meadow-horn-b94.notion.site/halo-File-Upload-Vulnerability-14c42bd5b11880d58e11cd976f8e9d4f Broken Link

CPE matches (NVD) (1)

cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:* < 2.20.13

CVSS score

6.1Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

All scores (2)

CISA-ADP	CVSS 3.1	6.1Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	6.1Medium

EPSS (chance of exploitation in 30 days)

0.26%

higher than 17% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-04-22
Published2025-09-09 03:00
Reached IP-DB2026-10-24 23:57
Last updated2026-11-07 21:10

Assigned by (CNA): mitre
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time