p PatchFirst

CVE-2026-55629

CVE-2026-55629 · Whistle: Path traversal

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename directly to getFile, allowing a remote attacker to read arbitrary files such as /etc/passwd. This issue is reported as fixed in version 2.10.3.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • whistle

    Versions
    • < 2.10.3: Affected

    No fix published

  • whistle npm

    Affected ranges
    • SEMVER: < 2.10.3

    Update to 2.10.3

Original sources

Check your server →