The halo-dev halo product up to version 2.24.2 contains a path traversal vulnerability in the Download function of the MigrationEndpoint.java file in the Files Backup Endpoint component. This vulnerability enables remote attackers to manipulate file paths to access files outside the intended directory. The vulnerability has been assigned CVE-2026-16088 and has a CVSS 4.0 base score of 5.1, indicating medium severity. Although exploit code is publicly available, no official fix or patch has been released, and the vendor has not provided remediation details. The affected versions are specifically 2.24.0, 2.24.1, and 2.24.2.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal attacks, potentially accessing sensitive files outside the intended directories. This could lead to unauthorized disclosure of information. The CVSS vector indicates low confidentiality, integrity, and availability impact, with no user interaction required and no privileges needed beyond high privileges (PR:H). The exploit is publicly known but not confirmed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released, users should monitor vendor communications for updates. Until a patch is available, restrict access to the vulnerable endpoint and apply network-level controls to limit exposure. Avoid exposing the affected service to untrusted networks.