Most recent entries from all

EUVD-2026-268884

2026-10-08T03:23:15.944309+00:00

EUVD-2026-268884

fkie_cve-2026-25766

2026-10-08T03:23:15.944349+00:00

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.

GHSA-pgvm-wxw2-hrv9 — Echo has a Windows path traversal via backslash in middleware.Static default filesystem

2026-10-08T03:23:15.944390+00:00

Affected: Go: github.com/labstack/echo/v5

### Summary On Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root.

### Details

In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does **not** treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root.

Relevant code: - `middleware/static.go` (path unescape + `path.Clean` + `currentFS.Open`) - `echo.go` `defaultFS.Open` → `os.Open`

This is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the `path.Clean` + defaultFS combination reintroduces the Windows backslash traversal.

### PoC Windows only.

**Sample code (main.go):** ```go package main

import ( "log" "net/http"

"github.com/labstack/echo/v5" "github.com/labstack/echo/v5/middleware" )

func main() { e := echo.New()

// Important: use middleware.Static with default filesystem (nil) e.Use(middleware.Static("public"))

e.GET("/healthz", func(c *echo.Context) error { return c.…