Vulnerability · Published Jun 9, 2025 · Assigned by VulDB

CVE-2025-5880Whistle get-temp-file path traversal

Medium 4.3

In plain English

A medium-severity path traversal in Whistle. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-file. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	Whistle	2.9.98

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-311638 | Whistle get-temp-file path traversal vdb-entry, technical-description
VDB-311638 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #582867 | Whistle whistle 2.9.98 Path Traversal third-party-advisory