CVE-2024-56156 is a critical severity flaw (CVSS 9.0) in Halo, an open source website building tool. Before version 2.20.13, attackers can bypass file type validation and upload executables or HTML files, which can lead to stored cross-site scripting and, in some setups, code execution. Upgrade to 2.20.13 or later.
What's affected
The GitHub security advisory GHSA-99mc-ch53-pqh9 for Halo lists the affected versions as 2.20.12 and earlier, and the patched version as 2.20.13. The advisory does not list a package name, because Halo is shipped as an application and container image rather than a library.
If you run any Halo release before 2.20.13, you are in scope. That includes self hosted sites, container deployments and any staging copy that accepts uploads from users with an account.
How to check if you're exposed
Check the installed version in the Halo administration console, or through the image tag if you deploy with containers:
docker ps --format "table {{.Names}}\t{{.Image}}"
An image tag below 2.20.13 means you need to upgrade. If your deployment uses a floating tag, confirm the running version in the console, because the tag may not say.
Then ask who can upload files. The vector in the record shows low privileges and user interaction, so an attacker needs an account that can upload attachments, and a victim has to load the file. Sites that allow open registration or have many editors face the highest risk. Finally, review what has already been uploaded. Look in the attachment store for HTML files or executables that do not belong, especially any uploaded under an image name.
What to do now
- Upgrade Halo to 2.20.13 or later and restart the service.
- Audit the attachment storage for HTML files, scripts and executables that were uploaded as something else, and remove anything you cannot explain.
- Reduce who can upload. Remove upload rights from accounts that do not need them, and disable open registration if you do not use it.
- Serve uploaded content from a separate domain or with headers that stop the browser from running it, so a stored file cannot act as part of your main site.
- Review recent uploads against account activity for users you do not recognize.
- Add Halo to your dependency and image inventory so the next release is noticed.
Why it matters
The weakness is CWE-79, but the root is a validation gap. The fix, in pull request 7149, is titled as a fix for an XSS vulnerability caused by polyglot file type upload. A polyglot file is valid as more than one type at once. A check that decides the type by looking at one signal can be fooled when the file satisfies a harmless type and a dangerous one together.
Once a browser renders an uploaded HTML file from your own domain, the script inside runs with the site's trust. That is stored cross-site scripting, and it can act as the logged in user. The advisory also says remote code execution is possible under certain circumstances. The score is critical because scope changes in the vector, meaning the impact goes beyond the vulnerable component. The record's KEV flag is false, so there is no catalog listing of active exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Halo version fixes CVE-2024-56156?
Version 2.20.13, according to the project's GitHub security advisory.
Do I need to worry if only trusted staff upload files?
Less so, but the fix is still worth applying. A staff account that is phished or reused elsewhere becomes the upload path.
Sources
Last reviewed: 19 October 2026.
