CVE-2024-56156
Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.
Reserved 2024-12-17 | Published 2025-04-25 | Updated 2025-04-25 | Assigner GitHub_MCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
github.com/...v/halo/security/advisories/GHSA-99mc-ch53-pqh9
github.com/halo-dev/halo/pull/7149
Support options
