Nixpkgs security tracker
2.0 LOW
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): High (H)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Exploit Maturity (E): POC (P)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): High (H)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored
-
@LeSuisse
ignored
3 packages
- eschalot
- python313Packages.halo
- python314Packages.halo
halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal
A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
References
-
VDB-379798 | halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal technical-descriptionvdb-entry
-
Submit #853097 | halo <=2.24.2 Arbitrary File Read third-party-advisory
-
Ignored references (3)
-
-
CVE-2026-16088 | CVE Analysis and Report third-party-advisory
Affected products
- ==2.24.1
- ==2.24.2
- ==2.24.0
Matching in nixpkgs
pkgs.halo
Self-hosted dynamic blogging program
pkgs.typstPackages.whalogen
Typesetting chemical formulae, a port of mhchem
pkgs.python313Packages.halohome
Python library to control Eaton HALO Home Smart Lights
pkgs.python314Packages.halohome
Python library to control Eaton HALO Home Smart Lights
pkgs.typstPackages.whalogen_0_1_0
Typesetting chemical formulae, a port of mhchem
pkgs.typstPackages.whalogen_0_2_0
Typesetting chemical formulae, a port of mhchem
pkgs.typstPackages.whalogen_0_3_0
Typesetting chemical formulae, a port of mhchem
pkgs.python313Packages.django-cachalot
No effort, no worry, maximum performance
Ignored packages (3)
pkgs.eschalot
Tor hidden service name generator
-
nixos-unstable 1.2.0.20191006
- nixpkgs-unstable 1.2.0.20191006
- nixos-unstable-small 1.2.0.20191006
-
nixos-26.05 1.2.0.20191006
- nixos-26.05-small 1.2.0.20191006
- nixpkgs-26.05-darwin 1.2.0.20191006
pkgs.python313Packages.halo
Beautiful Spinners for Terminal, IPython and Jupyter
Package maintainers
-
@RossSmyth Ross Smyth
-
@cherrypiejam Gongqi Huang
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@onny Jonas Heinrich <onny@project-insanity.org>