highCVE-2026-55629Aug 25, 2026

CVE-2026-55629: whistle Arbitrary File Read via Path Traversal

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Whistle's debug proxy exposes any file on the host filesystem to anyone who can reach port 8899, because a single API endpoint passes user-supplied filenames straight to the file-read function…

Packagewhistle
Ecosystemnpm
Affected< 2.10.3
Fixed in2.10.3
CVE-2026-55629: whistle Arbitrary File Read via Path Traversal

The problem

The GET /cgi-bin/temp/get endpoint in lib/service/service.js reads a filename query parameter and joins it to a safe temp directory only when it matches the pattern TEMP_FILE_RE (a temp/<hash> shape).

If the filename does not match that pattern, the code skips the join entirely and passes the raw, attacker-controlled string directly to getFile. No authentication, no further check. Any file the whistle process can read on disk is exposed.

Proof of concept

A working proof-of-concept for CVE-2026-55629 in whistle, with the exact payload below.

bash
curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd"

The root cause is a missing else-branch rejection. The original code only handled the "good" case (filename matches the pattern, join to safe path) and silently fell through to getFile(filename) for everything else. An absolute path like /etc/passwd never matches TEMP_FILE_RE, so it hits getFile verbatim.

The patch at commit 777bcf69 adds an early return (or equivalent error response) in the branch where the filename fails the regex check, so the request is rejected rather than forwarded. This closes the CWE-22 path-traversal by enforcing that only validated, path-joined filenames are ever read.

CVSS 4.0 score is 8.7 (High): network-reachable, no authentication required, no user interaction needed, full confidentiality impact.

The fix

Upgrade whistle to version 2.10.3 or later (npm install -g whistle@latest). The fix is in commit 777bcf69bae2972aa7138a158c91619185653cf5. If immediate upgrade is not possible, restrict network access to the whistle port (default 8899) to localhost only using a firewall rule.

Reported by nova (automated tool, Song Wu group, Zhejiang University), Bo Wang (independent researcher), Xingwei Lin (Zhejiang University).

References: [1][2][3][4][5]

Related research