Is CVE-2026-55439 actively exploited?

No active exploitation of CVE-2026-55439 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-55439 be exploited remotely?

Yes. CVE-2026-55439 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-55439?

CVE-2026-55439 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-55439

MEDIUM

CVE-2026-55439

CWE-22Published: June 25, 2026· Updated: Jun 25, 2026

5.5

CVSS v3.1

EPSS:0.34%probability of exploitation in 30 daysPercentile:25.6th

Official Description

Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.

NVD Source

Technical Analysis

CVE-2026-55439 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.