CVE-2026-32733: 
NixOS vulnerability analysis and mitigation

CVE-2026-32733 is a path traversal vulnerability (CWE-22) in Halloy, an IRC client written in Rust, affecting all versions up to and including 2026.4. The DCC (Direct Client-to-Client) file receive flow failed to sanitize filenames from incoming DCC SEND requests, allowing a remote IRC user to write files to arbitrary locations on the victim's filesystem. The vulnerability was published on March 20, 2026, and remediated in commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In data/src/dcc.rs, the Send::decode() function parsed the filename from the incoming DCC SEND message and only trimmed quotation marks — directory separators and .. sequences were never stripped. The unsanitized filename was then stored in the FileTransfer struct and later joined to the configured save_directory using PathBuf::join, which respects relative path components, allowing traversal outside the intended directory. This affected four distinct code paths: DCC protocol parsing, receive request storage, auto-accept path construction, and manual approval path construction. The fix introduces a shared sanitize_filename function that uses Path::file_name() to extract only the final filename component, stripping all traversal sequences, and replaces control characters (GitHub Advisory, Fix Commit).

Successful exploitation allows a remote IRC user to write arbitrary files to any location on the victim's filesystem where the Halloy process has write permissions. This enables overwriting critical files such as shell configs (.bashrc, .zshrc), planting SSH authorized_keys, dropping executables into startup/autorun directories, or replacing application configs — all of which can lead to code execution on the next login or reboot. When auto-accept is enabled (not the default), exploitation requires zero interaction from the victim; when auto-accept is disabled but a save_directory is configured, a single user click suffices, as the actual destination path is never displayed to the user (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory — no script is required, as the attack is a single crafted IRC message: PRIVMSG victim :\x01DCC SEND ../../../tmp/pwned 2130706433 12350 5\x01. The advisory classifies this as a real, actionable exploit with high confidence. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.046% (GitHub Advisory).

1. Reconnaissance: Identify a target using Halloy IRC client version ≤ 2026.4 with DCC file transfers enabled (the default) and a save_directory configured, or with auto-accept enabled.
2. Connect to the shared IRC server: Join the same IRC server and channel as the victim, or send a direct message. Any IRC client or raw TCP connection to the IRC server can be used.
3. Craft the malicious DCC SEND message: Construct a CTCP DCC SEND message with a path traversal filename, e.g.:

   PRIVMSG victim :\x01DCC SEND ../../../tmp/pwned 2130706433 12350 5\x01

   where 2130706433 is the decimal encoding of 127.0.0.1 (or the attacker's IP), 12350 is the listening port, and 5 is the file size.
4. Serve the file content: Listen on the specified port and serve the desired file content when the victim's Halloy client connects (direct mode) or initiate a reverse connection (passive mode).
5. Trigger file write: If auto-accept is enabled, the file is written automatically with zero victim interaction. If manual approval is required, the victim sees a transfer request and clicks accept — the actual traversed destination path is never displayed.
6. Achieve persistence or code execution: The file lands at the traversed path (e.g., /tmp/pwned, ~/.ssh/authorized_keys, or a startup directory), enabling persistence, SSH access, or code execution on next login/reboot (GitHub Advisory).

• Network: Unexpected inbound DCC SEND CTCP messages in IRC traffic containing .. or \.. sequences in the filename field; outbound TCP connections from the Halloy process to unfamiliar IP addresses on non-standard ports (e.g., high ephemeral ports) immediately following a DCC SEND message.
• File System: Unexpected files appearing outside the configured save_directory, particularly in sensitive locations such as ~/.ssh/authorized_keys, ~/.bashrc, ~/.zshrc, cron directories (e.g., /etc/cron.d/), or OS startup/autorun folders; files with timestamps correlating to IRC session activity.
• Logs: IRC client logs or system logs showing DCC SEND requests with filenames containing ../ or ..\ sequences; file creation events (via auditd or similar) by the Halloy process outside its expected download directory.
• Process: Halloy process spawning unexpected child processes or making unusual network connections after a file transfer event (GitHub Advisory).

Update Halloy to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6 or any release that includes this fix, as all identified code paths now sanitize filenames through the shared sanitize_filename function. As an interim workaround if upgrading is not immediately possible, disable auto-accept for DCC transfers (it is off by default) to require user interaction before any file is written, and avoid configuring a save_directory to prevent the silent path join. Disabling DCC file transfers entirely also fully mitigates the vulnerability (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher melocene and remediated by Halloy maintainer casperstorm. A NixOS package update pull request (nixpkgs #503267) was opened to update the Halloy package to the patched version, indicating prompt community response. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory (GitHub Advisory).