PT-2026-26687 · Halloy · Halloy

Melocene · Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-32733

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Halloy versions prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6

Description Halloy, an IRC application written in Rust, had a flaw in its DCC receive flow. Before commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, filenames received through DCC SEND requests were not properly sanitized. This allowed a remote IRC user to potentially write files outside the user’s designated save directory by crafting filenames with path traversal sequences, such as ../../.ssh/authorized keys. If auto-accept was enabled, this could occur without any interaction from the victim. The issue stemmed from a lack of filename sanitization during the DCC receive process.

Recommendations Update Halloy to a version with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32733

GHSA-FQRV-RFG4-RV89

Affected Products

Halloy

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32733.json · Exploit
• https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 · Patch
• https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32733 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32733 · Vendor Advisory
• https://twitter.com/CVEnew/status/2035262134548922479 · Twitter Post