CVE-2026-32733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32733
Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming `DCC SEND` requests. A remote IRC user could send a filename with path traversal sequences like `../../.ssh/authorized_keys` and the file would be written outside the user's configured `save_directory`. With auto-accept enabled this required zero interaction from the victim. Starting with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, all identified code paths sanitize filenames through a shared `sanitize_filename` function.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 Patch
https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:halloy:halloy:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:36

Type Values Removed Values Added
Summary
  • (es) Halloy es una aplicación de IRC escrita en Rust. Antes del commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, el flujo de recepción DCC no saneaba los nombres de archivo de las solicitudes entrantes 'DCC SEND'. Un usuario remoto de IRC podría enviar un nombre de archivo con secuencias de salto de ruta como '../../.ssh/authorized_keys' y el archivo se escribiría fuera del 'save_directory' configurado por el usuario. Con la autoaceptación habilitada, esto no requería ninguna interacción de la víctima. A partir del commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, todas las rutas de código identificadas sanean los nombres de archivo a través de una función compartida 'sanitize_filename'.

23 Mar 2026, 19:21

Type Values Removed Values Added
References () https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 - () https://github.com/squidowl/halloy/commit/0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 - Patch
References () https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 - () https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 - Exploit, Vendor Advisory
CPE cpe:2.3:a:halloy:halloy:*:*:*:*:*:*:*:*
First Time Halloy halloy
Halloy
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

20 Mar 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 23:16

Updated : 2026-06-17 10:36

NVD link : CVE-2026-32733

Mitre link : CVE-2026-32733

CVE.ORG link : CVE-2026-32733

JSON object : View

Products Affected

halloy

  • halloy
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')