Threats affecting pkg:brew/whistle

Whistle versions prior to 2.10.3 contain a path traversal vulnerability in the /cgi-bin/temp/get endpoint. The application improperly handles the filename parameter, allowing an attacker to read arbitrary files on the server by supplying a filename that does not match the expected pattern. This can lead to unauthorized disclosure of sensitive files such as /etc/passwd or /etc/hosts.

Avenwu Whistle versions 2.9.90 and earlier are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform malicious API calls. This can lead to the execution of arbitrary code on the victim's machine. The vulnerability is fixed in version 2.10.8.