VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026

CVE-2025-44593

CVE-2025-44593

Description

Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13

Affected products

3
  • Halo Dev/Halo3 versions
    cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*range: <2.20.13
    • (no CPE)
    • (no CPE)range: <2.20.13

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.