Path Traversal Vulnerability in Halo Website Builder by Halo Dev

CVE-2026-55439

What is CVE-2026-55439?

Halo, an open-source website building tool, contains a path traversal vulnerability in the backup download endpoint prior to version 2.24.3. This flaw allows authenticated administrators to access arbitrary files from the server's filesystem. Specifically, the vulnerability arises from a lack of validation when resolving backup filenames, as the endpoint does not ensure that the resolved paths remain within a specified backups directory. Additionally, there are issues with sanitization in the backup creation endpoint. These security weaknesses highlight critical security risks for users and require immediate attention to ensure data integrity.

References