Whistle is a debugging proxy that handles HTTP, HTTPS and WebSocket traffic. A path traversal flaw in lib/service/service.js allows a remote attacker to supply a malicious filename in a GET request to /cgi-bin/temp/get. When the filename does not match the expected temporary file pattern, the application passes the user supplied value directly to getFile, enabling the reading of arbitrary files such as /etc/passwd. This grants the attacker confidential information from the host system.

Avwo Whistle releases prior to version 2.10.3 are affected, meaning any installation running an older version is vulnerable to this file read issue.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score of <1% indicates that, as of this analysis, the probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness through a single HTTP GET request to the proxy, requiring only network access to the /cgi-bin/temp/get endpoint. Because the vulnerability permits the reading of arbitrary files, it can compromise confidentiality on the host running Whistle, although it does not provide code execution or privilege escalation.