HIGH GitHub
CVE-2026-55629
Whistle vulnerable to path traversal
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.
**Vulnerability detail**:
In service.js, inside
`app.get('/cgi-bin/temp/get', ...):
var filename = req.query.filename;
if (TEMP_FILE_RE.test(filename)) {
filename = path.join(TEMP_FILES_PATH, filename);
}
getFile(filename, ...);`
Only when filename matches the temp/<hash> pattern does it get joined to the safe director
Affected Products
- npm/whistle < 2.10.3
References
- https://github.com/advisories/GHSA-3vfr-4gwf-qxfp
- https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55629
- https://github.com/avwo/whistle/commit/777bcf69bae2972aa7138a158c91619185653cf5
This high severity vulnerability was published on 2026-08-25 via GitHub. Affected: npm/whistle < 2.10.3.
vulnfeed aggregates 11950 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.