Halo · Halo · CVE-2026-55439
**Name of the Vulnerable Software and Affected Versions**
Halo versions prior to 2.24.3
**Description**
An issue in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The endpoint 'GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}' within the `download()` function of MigrationServiceImpl uses Path.resolve() to handle the `filename` variable without verifying that the resulting path remains inside the intended backups directory. Additionally, the backup creation endpoint 'POST /apis/migration.halo.run/v1alpha1/backups' fails to sanitize status fields during the creation process.
**Recommendations**
Update to version 2.24.3.