CVE-2025-44595

Halo versions v2.20.17 and before are susceptible to a Cross Site Scripting (XSS) vulnerability within the /halo_host/archives/{name} API endpoint. The root cause is the improper handling of the name parameter, which allows for potential script injection . Successful exploitation could lead to th...