Path traversal in Whistle HTTP debugging proxy (CVE-2026-55629)

Whistle, an HTTP/HTTP2/HTTPS/WebSocket debugging proxy, contains a path traversal vulnerability in lib/service/service.js. The GET /cgi-bin/temp/get endpoint uses a user-supplied filename parameter directly for file reading when the value does not match the expected temporary file pattern, bypassing directory restrictions and allowing a remote attacker to read arbitrary files from the host system (e.g., /etc/passwd, /etc/hosts). Affected versions: - < 2.10.3 We recommend updating to: 2.10.3. CVSS 8.7 · our assessment: this_week Vendor advisory: https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp Details: https://vuln.today/cve/CVE-2026-55629