whistle vulnerabilities

1 known vulnerability in whistle from Avwo. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  whistle: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-55629Jul 16, 2026Avwo

  Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise p