Whistle versions prior to 2.10.3 contain a path traversal vulnerability in the /cgi-bin/temp/get endpoint. The application improperly handles the filename parameter, allowing an attacker to read arbitrary files on the server by supplying a filename that does not match the expected pattern. This can lead to unauthorized disclosure of sensitive files such as /etc/passwd or /etc/hosts.