CVE-2024-56156

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.

• CWE-79

• https://github.com/halo-dev/halo/commit/24f8d7b57127e2607ec05adb7c912b3decddeb99
• https://github.com/halo-dev/halo/pull/7149Issue Tracking
• https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9Exploit, Mitigation, Vendor Advisory

Published

Apr 25, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-56141Minosoft is an open-source, multi-version Minecraft Java Edi…5
• CVE-2024-56142pghoard is a PostgreSQL backup daemon and restore tooling th…6.5
• CVE-2024-56143Strapi is an open-source headless content management system.…8.2
• CVE-2024-56144librenms is a community-based GPL-licensed network monitorin…5.4
• CVE-2024-56145Craft is a flexible, user-friendly CMS for creating custom d…9.8
• CVE-2024-5615The Open Graph plugin for WordPress is vulnerable to Sensiti…5.3
• CVE-2024-56157iTop is an web based IT Service Management tool. Prior to ve…6.3
• CVE-2024-56158XWiki is a generic wiki platform. It's possible to execute a…9.8
• CVE-2024-56159Astro is a web framework for content-driven websites. A bug …5.3
• CVE-2024-5616A Cross-Site Request Forgery (CSRF) vulnerability exists in …4.3
• CVE-2024-56161Improper signature verification in AMD CPU ROM microcode pat…7.2
• CVE-2024-56169A validation integrity issue was discovered in Fort through …5.3