CVE-2026-55629 Whistle: Path traversal
A remote attacker can read arbitrary files on the server hosting the Whistle debugging proxy due to improper input validation in the temporary file retrieval endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55629?
CVE-2026-55629 is a high-severity path traversal vulnerability in avwo whistle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename directly to getFile, allowing a remote attacker to read arbitrary files such as /etc/passwd. This issue is reported as fixed in version 2.10.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-55629?
2 open source packages ship an affected version, including whistle.
| Package | Affected | Fixed in |
|---|---|---|
whistle npm | All versions | 2.10.3 |
whistle npm | All versions | 2.10.3 |
How do I fix CVE-2026-55629?
Upgrade whistle to 2.10.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55629 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55629 exists.
Sources
Also known as GHSA-3vfr-4gwf-qxfp.