CVE-2026-32733 Details
Description
Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming `DCC SEND` requests. A remote IRC user could send a filename with path traversal sequences like `../../.ssh/authorized_keys` and the file would be written outside the user's configured `save_directory`. With auto-accept enabled this required zero interaction from the victim. Starting with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, all identified code paths sanitize filenames through a shared `sanitize_filename` function.
A path traversal vulnerability has been identified in the Halloy IRC application, written in Rust. Prior to commit 0f77b2c, the Direct Client-to-Client (DCC) receive process did not properly sanitize filenames from incoming DCC SEND requests. This oversight allowed remote IRC users to send filenames containing path traversal sequences, such as '../../.ssh/authorized_keys', which would be saved outside the user's designated save directory. With the auto-accept feature enabled, this exploitation required no user interaction. After commit 0f77b2c, all relevant code paths were updated to sanitize filenames using a shared function, addressing the vulnerability.
Users can disable DCC file transfers altogether, which will mitigate this vulnerability. For those who wish to keep DCC transfers enabled, it's important to be aware of the save directory configuration, as manual approval of transfers can still lead to exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| halloy halloy | <= 2026.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |