CVE-2026-32733 - Vulnerability Analysis

Overview

Halloy contains a path traversal vulnerability caused by unsanitized filenames in DCC SEND requests, letting remote IRC users write files outside the configured save directory, exploit requires auto-accept enabled.

Severity & Score

Impact

Remote attackers can write files outside the intended directory, potentially overwriting sensitive files and compromising the system.

Mitigation

Update to the version including commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 or later.

References

• https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6
• https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner