CVE-2025-44593

MEDIUM

halo < 2.20.13 - Stored Cross-Site Scripting via Malicious HTML File Upload

Title source: llm

Description

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13

References (1)

Core 1

Core References

Broken Link

https://meadow-horn-b94.notion.site/halo-File-Upload-Vulnerability-14c42bd5b11880d58e11cd976f8e9d4f

Scores

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 15.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

halo/halo < 2.20.13

Published Sep 09, 2025

Tracked Since Feb 18, 2026