PT-2025-17926 · Halo · Halo

Published 2025-04-25 · Updated 2026-02-03 · CVE-2024-56156

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Halo versions prior to 2.20.13

Description The issue allows attackers to bypass file type validation controls, enabling the upload of malicious files, including executables and HTML files. This can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances.

Recommendations For versions prior to 2.20.13, update to version 2.20.13 to resolve the issue. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation. Avoid using the file upload feature until the issue is resolved.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56156

GHSA-99MC-CH53-PQH9

Affected Products

Halo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56156.json · Exploit
• https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56156 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56156 · Vendor Advisory
• https://github.com/halo-dev/halo/pull/7149 · Note
• https://github.com/halo-dev/halo/commit/24f8d7b57127e2607ec05adb7c912b3decddeb99 · Note
• https://t.me/cveNotify/150784 · Telegram Post
• https://t.me/cvetracker/22388 · Telegram Post
• https://t.me/cvedetector/23761 · Telegram Post
• https://twitter.com/CVEnew/status/1915791437465375133 · Twitter Post
• https://twitter.com/SecAideInfo/status/1916810365284892680 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1915868190376133020 · Twitter Post