Halloy, an IRC client coded in Rust, suffered from a path traversal flaw in its DCC receive flow. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, filenames supplied by an incoming DCC SEND request were not sanitized, allowing an attacker to embed traversal characters such as ../../.ssh/authorized_keys. This weakness, classified as CWE‑22 (Path Traversal), would cause the client to write the file outside the configured save directory, enabling overwriting of arbitrary files on the victim’s file system. The impact is a remote arbitrary file write with potential to compromise confidentiality, integrity, or availability of the victim’s data.

The vulnerability applies to all releases of Halloy before the specified commit, regardless of the operating system. Users running an older Halloy version and enabling automatic acceptance of DCC file transfers are at risk; any user who allows incoming DCC SEND requests without manual confirmation is susceptible.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1 % suggests low current exploitation likelihood. Halloy is not listed in the CISA KEV catalog. Exploitation requires a victim to be connected to an IRC server that can send a DCC SEND request; the attacker must craft a malicious filename. With auto‑accept enabled, no user interaction is required, making remote exploitation straightforward. Attackers could potentially overwrite sensitive files such as authorized_keys, leading to privilege escalation or unauthorized access.