CVE-2025-44593

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cve@mitre.org

Published

2025-09-09

Last modified

2025-09-10

Weaknesses

CWE-79

Affected products

• Halo (Halo)

References

• https://meadow-horn-b94.notion.site/halo-File-Upload-Vulnerability-14c42bd5b11880d58e11cd976f8e9d4f