CVE-2026-55439

Name of the Vulnerable Software and Affected Versions Halo versions prior to 2.24.3

Description An issue in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The endpoint 'GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}' within the download() function of MigrationServiceImpl uses Path.resolve() to handle the filename variable without verifying that the resulting path remains inside the intended backups directory. Additionally, the backup creation endpoint 'POST /apis/migration.halo.run/v1alpha1/backups' fails to sanitize status fields during the creation process.

Recommendations Update to version 2.24.3.