CVE-2026-32733
Path Traversal in Halloy IRC DCC Send Allows Arbitrary File Write
Publication date: 2026-03-20
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| halloy | halloy | to 2026.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Halloy IRC application, which is written in Rust. Before a specific code commit, the application did not sanitize filenames received via DCC SEND requests. This allowed a remote IRC user to send a filename containing path traversal sequences (e.g., ../../.ssh/authorized_keys), causing the file to be saved outside the intended directory.
If the auto-accept feature was enabled, the victim did not need to interact for the malicious file to be saved, making exploitation easier. The issue was fixed by introducing a shared filename sanitization function in the code.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized file writes outside the user's designated save directory. An attacker could overwrite or create files in sensitive locations on the victim's system by exploiting path traversal in filenames.
Such unauthorized file writes could compromise system integrity, potentially allowing attackers to modify configuration files or inject malicious content without user interaction if auto-accept is enabled.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you are using a version of Halloy IRC application that includes the commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 or later, as this commit sanitizes filenames in incoming DCC SEND requests to prevent path traversal.
Additionally, consider disabling the auto-accept feature for DCC SEND requests to prevent zero-interaction exploitation.