CVE-2024-56156
Critical
Description
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Halo
PublishedApr 25, 2025
First seenApr 25, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- halo halo2.20.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| halo halo | v < 2.20.13 | 2.20.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.