{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/whistle-2.10.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-55629"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["whistle (2.10.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eWhistle, an HTTP proxy tool, is susceptible to a path traversal vulnerability identified as CVE-2026-55629. The flaw resides in the service.js file, specifically within the /cgi-bin/temp/get route. The application implements a regex check (TEMP_FILE_RE) intended to restrict file access to a designated directory; however, the validation logic is flawed. If the provided filename parameter does not match the expected pattern, the application fails to reject the request. Instead, it processes the unsanitized user-supplied input directly, enabling the retrieval of arbitrary files outside of the intended directory. This vulnerability affects Whistle versions prior to 2.10.3 and poses a significant risk as it allows an unauthenticated remote attacker to read sensitive system files, such as /etc/passwd or /etc/hosts, simply by supplying a path as a query parameter.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify a server running an outdated version of Whistle (v \u0026lt; 2.10.3).\u003c/li\u003e\n\u003cli\u003eAttacker probes the /cgi-bin/temp/get endpoint to determine if path traversal is possible.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious HTTP GET request targeting the /cgi-bin/temp/get endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a path traversal sequence or an absolute path (e.g., /etc/passwd) into the 'filename' query parameter.\u003c/li\u003e\n\u003cli\u003eThe application's service.js router receives the request and evaluates the filename against the regex.\u003c/li\u003e\n\u003cli\u003eDue to the flawed logic, the regex fails to catch the malicious input and passes the unsanitized filename to the getFile function.\u003c/li\u003e\n\u003cli\u003eThe application reads the requested file from the filesystem.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the unauthorized file in the HTTP response body, leading to information disclosure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in unauthorized access to sensitive files on the server hosting the Whistle proxy. This can lead to the exposure of credentials, configuration files, system identity details, and other sensitive information. The vulnerability affects any server running Whistle version 2.10.3 or lower, which is commonly used in development and debugging environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Whistle npm package to version 2.10.3 or later immediately to apply the patch for CVE-2026-55629.\u003c/li\u003e\n\u003cli\u003eAudit existing logs for anomalous access to the /cgi-bin/temp/get endpoint, specifically looking for GET requests containing path traversal characters like \u0026quot;../\u0026quot; or absolute file paths.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to webserver logs to detect exploitation attempts targeting this endpoint.\u003c/li\u003e\n\u003cli\u003eImplement network access controls to restrict access to the Whistle administration interface to trusted internal IP ranges only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T18:48:58Z","date_published":"2026-08-25T18:48:58Z","id":"https://feed.craftedsignal.io/briefs/2026-08-whistle-path-traversal/","summary":"The Whistle npm package contains a path traversal vulnerability (CVE-2026-55629) in the /cgi-bin/temp/get endpoint, allowing unauthorized attackers to read arbitrary files from the filesystem.","title":"Path Traversal Vulnerability in Whistle","url":"https://feed.craftedsignal.io/briefs/2026-08-whistle-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Whistle (2.10.2)","version":"https://jsonfeed.org/version/1.1"}