CVE-2024-56156: Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
Vulnerability summary
CVE-2024-56156 is a critical (CVSS 9.0) vulnerability in halo-dev halo. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 57.5% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 25-04-2025PublishedVulnerability first disclosed.
- 03-02-2026Last modifiedVulnerability information updated.
Description
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.81% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundHalo
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Halo1 product
- halo< 2.20.13
Halo-dev1 product
- halo< 2.20.13
2 vendors · 2 products
References
3 links- github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9X Refsource CONFIRMExploitMitigationVendor Advisory