CVE-2025-44593

Halo before version 2.20.13 is affected by a vulnerability where file type detection can be bypassed, allowing upload of malicious files such as .exe and .html. The upload of .html files can trigger stored XSS. This issue is fixed in 2.20.13. Affected product/versions are Halo prior to 2.20.13; r...