CVE-2026-55629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55629
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55629.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55629
Aliases
Published
2026-07-16T19:12:56Z
Modified
2026-10-28T02:31:01Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Whistle: Path traversal
Details

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename directly to getFile, allowing a remote attacker to read arbitrary files such as /etc/passwd. This issue is reported as fixed in version 2.10.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55629.json"
}
References

Affected packages

Git / github.com/avwo/whistle

Affected ranges

Type
GIT
Repo
https://github.com/avwo/whistle
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e96fef727e9b491efb60e49f69d514b00a37fd79
Fixed
777bcf69bae2972aa7138a158c91619185653cf5
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.10.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "777bcf69bae2972aa7138a158c91619185653cf5"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.10.3",
            "range": [
                {
                    "fixed": "e96fef727e9b491efb60e49f69d514b00a37fd79"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.2
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.12.2
v0.12.3
v1.*
v1.0.0
v1.0.1
v1.0.3
v1.0.4
v1.1.0
v1.1.1
v1.1.2
v1.10.1
v1.10.10
v1.10.2
v1.10.3
v1.10.4
v1.10.5
v1.10.6
v1.10.8
v1.10.9
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.12.0
v1.12.1
v1.12.10
v1.12.11
v1.12.12
v1.12.13
v1.12.14
v1.12.15
v1.12.16
v1.12.17
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.13.0
v1.13.1
v1.13.10
v1.13.11
v1.13.12
v1.13.13
v1.13.14
v1.13.15
v1.13.16
v1.13.17
v1.13.18
v1.13.2
v1.13.21
v1.13.22
v1.13.23
v1.13.24
v1.13.25
v1.13.26
v1.13.27
v1.13.28
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.14.0
v1.14.1
v1.14.10
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.14.9
v1.15.0
v1.15.1
v1.15.10
v1.15.11
v1.15.12
v1.15.13
v1.15.14
v1.15.15
v1.15.16
v1.15.2
v1.15.3
v1.15.4
v1.15.5
v1.15.7
v1.15.8
v1.15.9
v1.16.0
v1.16.1
v1.16.10
v1.16.11
v1.16.12
v1.16.13
v1.16.2
v1.16.3
v1.16.4
v1.16.5
v1.16.6
v1.16.7
v1.16.8
v1.16.9
v1.17.0
v1.17.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.3.0
v1.3.1
v1.3.10
v1.3.11
v1.3.12
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.19
v1.3.2
v1.3.20
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.17
v1.4.18
v1.4.19
v1.4.2
v1.4.20
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.14
v1.5.15
v1.5.16
v1.5.17
v1.5.18
v1.5.3
v1.5.4
v1.5.5
v1.5.6
v1.5.7
v1.5.8
v1.5.9
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.10
v1.9.11
v1.9.12
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.9
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.10.0
v2.10.1
v2.10.2
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.7
v2.4.0
v2.4.1
v2.4.10
v2.4.11
v2.4.12
v2.4.14
v2.4.15
v2.4.17
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.4.9
v2.5.0
v2.5.1
v2.5.10
v2.5.11
v2.5.12
v2.5.13
v2.5.14
v2.5.15
v2.5.16
v2.5.17
v2.5.18
v2.5.19
v2.5.2
v2.5.20
v2.5.21
v2.5.22
v2.5.23
v2.5.24
v2.5.25
v2.5.26
v2.5.27
v2.5.28
v2.5.29
v2.5.3
v2.5.30
v2.5.31
v2.5.32
v2.5.5
v2.5.6
v2.5.7
v2.5.8
v2.5.9
v2.6.0
v2.6.1
v2.6.10
v2.6.11
v2.6.12
v2.6.13
v2.6.14
v2.6.15
v2.6.16
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.14
v2.7.15
v2.7.16
v2.7.17
v2.7.18
v2.7.19
v2.7.2
v2.7.20
v2.7.21
v2.7.22
v2.7.23
v2.7.24
v2.7.25
v2.7.26
v2.7.27
v2.7.28
v2.7.29
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.10
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v2.9.0
v2.9.1
v2.9.10
v2.9.100
v2.9.101
v2.9.102
v2.9.104
v2.9.105
v2.9.106
v2.9.107
v2.9.108
v2.9.109
v2.9.11
v2.9.12
v2.9.13
v2.9.14
v2.9.15
v2.9.16
v2.9.17
v2.9.18
v2.9.19
v2.9.2
v2.9.20
v2.9.21
v2.9.22
v2.9.23
v2.9.25
v2.9.26
v2.9.27
v2.9.28
v2.9.29
v2.9.3
v2.9.30
v2.9.31
v2.9.32
v2.9.33
v2.9.34
v2.9.35
v2.9.36
v2.9.37
v2.9.38
v2.9.39
v2.9.4
v2.9.40
v2.9.41
v2.9.42
v2.9.43
v2.9.44
v2.9.45
v2.9.46
v2.9.47
v2.9.48
v2.9.5
v2.9.50
v2.9.51
v2.9.52
v2.9.53
v2.9.54
v2.9.55
v2.9.56
v2.9.57
v2.9.58
v2.9.59
v2.9.6
v2.9.60
v2.9.61
v2.9.62
v2.9.63
v2.9.64
v2.9.65
v2.9.66
v2.9.67
v2.9.68
v2.9.69
v2.9.7
v2.9.70
v2.9.71
v2.9.72
v2.9.73
v2.9.74
v2.9.75
v2.9.76
v2.9.77
v2.9.78
v2.9.8
v2.9.80
v2.9.81
v2.9.82
v2.9.84
v2.9.85
v2.9.86
v2.9.87
v2.9.88
v2.9.89
v2.9.9
v2.9.90
v2.9.92
v2.9.93
v2.9.94
v2.9.95
v2.9.96
v2.9.97
v2.9.98
v2.9.99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55629.json"