Which versions of Whistle are affected by CVE-2025-5880?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-5880, a path traversal vulnerability rated CVSS 4.3. This could allow unauthorized file access.

How to fix or mitigate CVE-2025-5880?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Whistle CVE-2025-5880

Q: What is the CVSS score of CVE-2025-5880?

CVE-2025-5880 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-17473 LOW

Path Traversal (CWE-22)

2025-06-09 cna@vuldb.com

Path Traversal

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Adjacent network, low complexity, no privileges, no interaction, low confidentiality impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17473

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 14:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-file. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal vulnerability in Whistle 2.9.98 allows attackers to read arbitrary files via the /cgi-bin/sessions/get-temp-file endpoint by manipulating the filename argument. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a path traversal (CWE-22) in Whistle, a web debugging proxy. The affected endpoint /cgi-bin/sessions/get-temp-file fails to sanitize user-supplied filename input, allowing directory traversal sequences (e.g., ../) to access files outside the intended directory. CPE data is not provided, but the product is Whistle version 2.9.98.

RemediationAI

No official patch is available as the vendor did not respond. As a workaround, restrict access to the /cgi-bin/sessions/get-temp-file endpoint via firewall rules or web server configuration, or disable the CGI functionality if not needed. Monitor for unauthorized file access attempts.