Approved changes feed: RSS · Atom
cpe:2.3:a:halloy:halloy:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Halloy (d61d270c-c576-56b9-991a-259c8f3d1669) |
|---|---|
| Product | Halloy (b6078457-5389-5d43-8283-80c51c2e69bd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32810 |
vulnerable | 2026-06-08 07:57:18.166589 |
Halloy has insecure file permissions on credential files
Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue.
Published: 2026-03-20T22:40:49.237Z
Updated: 2026-03-23T21:41:38.612Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32733 |
vulnerable | 2026-06-08 07:57:18.098237 |
Halloy has a file transfer path traveral vulnerability
Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming `DCC SEND` requests. A remote IRC user could send a filename with path traversal sequences like `../../.ssh/authorized_keys` and the file would be written outside the user's configured `save_directory`. With auto-accept enabled this required zero interaction from the victim. Starting with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, all identified code paths sanitize filenames through a shared `sanitize_filename` function.
Published: 2026-03-20T22:37:39.365Z
Updated: 2026-03-24T02:06:30.856Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.