PT-2026-26687 · Halloy · Halloy

Melocene · Publicado 2026-03-20 · Atualizado 2026-03-21 · CVE-2026-32733

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Halloy versions prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6

Description Halloy, an IRC application written in Rust, had a flaw in its DCC receive flow. Before commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, filenames received through DCC SEND requests were not properly sanitized. This allowed a remote IRC user to potentially write files outside the user’s designated save directory by crafting filenames with path traversal sequences, such as ../../.ssh/authorized keys. If auto-accept was enabled, this could occur without any interaction from the victim. The issue stemmed from a lack of filename sanitization during the DCC receive process.

Recommendations Update Halloy to a version with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32733

GHSA-FQRV-RFG4-RV89

Produtos afetados

Halloy

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32733.json · Exploit
• https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 · Correção
• https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035262134548922479 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32733 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32733 · Aviso do Fabricante