CVE-2025-44593 - Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files

Back Back to CVE browser

MEDIUM

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files

Published Sep 9, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27586		Advisory
https://meadow-horn-b94.notion.site/halo-File-Upload-Vulnerability-14c42bd5b11880d58e11cd976f8e9d4f		Broken Link