CVE-2026-32733

Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming `DCC SEND` requests. A remote IRC user could send a filename with path traversal sequences like `../../.ssh/authorized_keys` and the file would be written outside the user's configured `save_directory`. With auto-accept enabled this required zero interaction from the victim. Starting with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, all identified code paths sanitize filenames through a shared `sanitize_filename` function.

• CWE-22

• https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6Patch
• https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89Exploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32728Parse Server is an open source backend that can be deployed …7.6
• CVE-2026-32729Runtipi is a personal homeserver orchestrator. Prior to 4.8.…8.8
• CVE-2026-3273A vulnerability was identified in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32730ApostropheCMS is an open-source content management framework…8.1
• CVE-2026-32731ApostropheCMS is an open-source content management framework…9.9
• CVE-2026-32732Lean 4 VS Code Extension is a Visual Studio Code extension f…0
• CVE-2026-32734baserCMS is a website development framework. Prior to versio…6.1
• CVE-2026-32735openapi-to-java-records-mustache-templates allows users to g…2.3
• CVE-2026-32736The Hytale Modding Wiki is a free service for Hytale mods to…4.3
• CVE-2026-32737Romeo gives the capability to reach high code coverage of Go…10
• CVE-2026-32738libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32739libheif is a HEIF and AVIF file format decoder and encoder. …6.5