CVE-2026-55629: Arbitrary File Read via Path Traversal in Whistle Proxy Internal Service

Whistle functions as a multi-protocol web debugging proxy. It is designed to intercept, modify, and inspect HTTP, HTTPS, WebSocket, and HTTP2 traffic. It is widely used by developers to debug API responses, inject scripts, and route local files to remote environments. Because of its administrative and utility capabilities, the utility runs with the permissions of the local system user starting the process.

In versions prior to 2.10.3, a path traversal vulnerability exists in the internal service module. The endpoint /cgi-bin/temp/get within this module exposes an interface intended to fetch temporary debugging files. When an external request queries this endpoint, the application extracts the target file from the filename query parameter.

Due to a failure in validating the filename string, unauthenticated remote attackers can traverse the host directory structure. This enables unauthorized read access to critical operating system files, application source code, and configurations. The vulnerability resides under the CWE-22 weakness class.

The vulnerability originates in the fail-open implementation of the query handling logic inside lib/service/service.js. Specifically, the routing layer maps incoming GET requests for the /cgi-bin/temp/get resource directly to an internal controller. This controller parses the filename value from the query string and evaluates it against an internal helper utility.

This helper utility is common.isTempFile(filename). It validates whether the string is a temporary file name. The validation relies on a regular expression, TEMP_FILE_RE = /^\^[\\da-f]{64}$/, designed to match 64-character hexadecimal hashes representing session files. If the parameter matches this structure, the logic appends the filename to the target directory root TEMP_FILES_PATH via path.join().

However, the critical security flaw lies in the handling of strings that do not match the regular expression. Instead of returning an error or halting execution when common.isTempFile returns false, the controller bypasses the path.join block entirely. It then proceeds to invoke the file retrieval utility getFile(filename, callback) with the raw, unvalidated string provided by the user. Because Node's underlying filesystem operations resolve relative and absolute paths directly, an attacker can specify any path on the disk, and the engine will fetch the file contents.

The remediation of CVE-2026-55629 required three distinct adjustments to ensure security. First, the export of the core service module was deactivated in the main entry point file lib/index.js. By omitting loadService from the public interface, the application prevents unauthorized or unintended registrations of internal service components.

Second, the maintainers integrated an authorization check into the routing middleware of lib/service/service.js. Every request directed to the session routing layer must now supply a unique identifier header named _x-whistle-uid_. If the request's header value does not match the active server configuration token config.uid, the controller terminates the request with a 403 Forbidden response.

Third, the validation mechanism was updated to prevent the fail-open scenario. The boolean validation helper common.isTempFile was deleted. In its place, the developers implemented common.getTempFile, which uses an updated regular expression /^(?:\/?temp\/)?([\da-f]{64})(?:\.[\w.-]+)?$/ to perform extraction rather than pure boolean testing. The path concatenation helper now only executes if a valid hash is actively extracted from the user input.

Below is the conceptual structure of the code before and after the application of the patch:

// BEFORE PATCH
var filename = req.query.filename;
if (common.isTempFile(filename)) {
  filename = path.join(TEMP_FILES_PATH, filename);
}
// If isTempFile returned false, the execution continued with the raw query string.
getFile(filename, function(em, data) { ... });
 
// AFTER PATCH
var filename = req.query.filename;
var tempFile = common.getTempFile(filename);
if (tempFile) {
  // The path.join function is now only reached if the format is matched.
  filename = path.join(TEMP_FILES_PATH, tempFile);
  getFile(filename, function(em, data) { ... });
} else {
  // If the format does not match, the application does not load raw file paths.
}

The change guarantees that an invalid temporary file parameter is never treated as a valid local system path, preventing arbitrary reads.

Exploitation of CVE-2026-55629 requires network connectivity to the active Whistle proxy port. The default port utilized is 8899. An attacker does not require any credentials, pre-existing sessions, or specific application configurations to execute this attack against unpatched versions.

To retrieve local system files, the attacker targets the exposed /cgi-bin/temp/get endpoint. They must formulate a query string containing the target file path. On Linux environments, the payload seeks files such as /etc/passwd. On Windows targets, standard system files such as C:/windows/win.ini or active project configuration files are used.

Upon receiving the payload, the backend fails to match the path string against the 64-character hexadecimal pattern. The application then falls through the routing logic and passes the relative or absolute path payload straight to the local filesystem API. The response returns the file's raw byte array to the client.

The impact of CVE-2026-55629 represents a severe risk to host confidentiality. Since Whistle is frequently executed by developers, engineers, and testing pipelines, the process holds the permission level of the host shell. Any files readable by the developer running the proxy are accessible to an attacker.

This access allows for the retrieval of configuration files, private SSH keys, cloud provider metadata tokens, and environment configurations. This disclosure can provide the lateral movement coordinates needed to access databases or production systems. Furthermore, in containerized or shared environments, the flaw can leak critical orchestration secrets.

The CVSS v4.0 base score is rated at 8.7. The vector reflects network availability, low complexity, and high confidentiality impact. Although the exploit status does not currently indicate active wild usage, the existence of trivial reproduction vectors makes rapid exploitation highly likely once an instance is discovered on the open internet.

The primary remediation for CVE-2026-55629 is updating the Whistle installation to version 2.10.3 or greater. The package is updated globally via the node package manager (npm). This update applies the logic changes, removes the deprecated services exports, and requires the unique header credential for endpoint interactions.

When immediate upgrades are impossible, network-level mitigations must be implemented. Administrators must verify that the Whistle proxy does not listen on wildcard addresses such as 0.0.0.0. Restricting the binding configuration to the local loopback address 127.0.0.1 blocks external connections.

# Command to bind Whistle to localhost exclusively
w2 start -p 8899 -h 127.0.0.1

Additionally, corporate networks must enforce firewall rules blocking ingress connections to port 8899 from external IP subnets. Any network monitoring infrastructure should flag HTTP query paths containing /cgi-bin/temp/get paired with suspicious query structures like double-dot paths or absolute system folders.