File Type Validation Bypass in Halo Website Builder

CVE-2024-56156

What is CVE-2024-56156?

Halo, an open-source website building tool, contains a vulnerability that allows attackers to bypass file type validation controls. This serious flaw enables the uploading of malicious files, such as executables and HTML files, potentially resulting in stored cross-site scripting attacks and remote code execution under specific conditions. This issue was addressed in the patch released in version 2.20.13, reinforcing the importance of keeping your software up to date.

References