Loading story…
A high-severity path traversal vulnerability tracked as CVE-2026-55629 was disclosed in Whistle, the HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. The flaw affects versions prior to 2.10.3 and stems from the /cgi-bin/temp/get handler in lib/service/service.js, which passed a user-controlled filename directly to file retrieval logic. An unauthenticated remote attacker could exploit the issue without user interaction to read arbitrary files on the host, including sensitive system files such as /etc/passwd.
The issue received a CVSS 4.0 score of 8.7 and was addressed in Whistle 2.10.3, with public references pointing to the project release, a fixing commit, and a GitHub security advisory. Subsequent project changes also show broader hardening in Whistle's service and temporary-file handling, including centralized temp-file utilities and a UID-based authorization check for service endpoints, alongside other fixes to proxy authorization, parsing, and plugin-related logic.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity path traversal vulnerability affecting Whistle versions prior to 2.10.3 was fixed in release 2.10.3. The flaw in the /cgi-bin/temp/get handler could let remote attackers read arbitrary files such as /etc/passwd without privileges or user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity path traversal flaw tracked as **CVE-2026-54650** was disclosed in the `openhole` project, affecting `openhole-server` and the CLI client in versions `0.1.1` and earlier. The bug stemmed from improper handling of request paths in the proxy chain: the server forwarded `r.URL.Path` instead of preserving the original escaped request target, while client-side proxy code constructed backend URLs in a way that let attacker-controlled paths pass through to local services. As a result, percent-encoded traversal sequences such as `%2e` and `%2f` could be interpreted as `../` and `/`, enabling remote access to unintended files. The vulnerability is classified as **CWE-22** with a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, indicating high confidentiality impact without requiring authentication or user interaction. Reported attack paths included requests such as `/../../etc/passwd` and encoded equivalents routed through the proxy to tunneled local backends. The issue was fixed in `openhole` version `0.1.2` by switching the server to `r.URL.EscapedPath()` and updating the client to build requests with a structured `url.URL` object that preserves `RawPath` and safely decodes `Path`.
Jul 29, 2026
CodeWhale version `0.8.64` fixes multiple high-severity vulnerabilities affecting the `codewhale` and `codewhale-tui` packages, including remote code execution, SSRF bypass, path traversal, and argument injection bugs. The most severe issue, **CVE-2026-75858**, allowed model-supplied Python code in `rlm_eval` to run automatically without honoring user approval settings, enabling local code execution through prompt-injection content delivered via web pages, fetched URLs, repository files, or MCP tool results. Additional flaws included **CVE-2026-75856**, a DNS pinning TOCTOU weakness that could bypass SSRF protections and reach internal network resources, and **CVE-2026-75914**, which let attackers abuse symlinks in `image_analyze` to read files outside the workspace and leak their contents to the vision endpoint. The release also addressed Git tool injection risks that could expose or modify local files. **CVE-2026-75912** allowed attackers to pass crafted `rev` values to `git_blame` and read arbitrary files through injected Git options, while **CVE-2026-75913** let malicious input reach `git_show` without proper validation or an end-of-options guard, enabling arbitrary file writes to targets such as `~/.ssh/authorized_keys` or shell configuration files. A related hardening commit shows CodeWhale tightened local tool trust boundaries by resolving hosts before `fetch_url` requests, sanitizing the child environment for JavaScript execution so parent secrets are not inherited, and canonicalizing image paths to block symlink escapes from the workspace.
Aug 18, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026