CVE-2026-25766 Echo has a Windows path traversal via backslash in middleware.Static default filesystem
An attacker can read arbitrary files outside the static root on Windows by exploiting backslash path traversal in the Echo framework's static middleware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25766?
CVE-2026-25766 is a medium-severity path traversal vulnerability in labstack echo, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-25766?
3 open source packages ship an affected version, including github.com/labstack/echo/v5. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/labstack/echo/v5 Go | From 5.0.0 | 5.0.3 |
github.com/labstack/echo/v5 Go | From 5.0.0 | 5.0.3 |
github.com/labstack/echo/v5 Go | From 5.0.0 | 5.0.3 |
Products include Labstack Echo.
How do I fix CVE-2026-25766?
Upgrade github.com/labstack/echo/v5 to 5.0.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25766 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25766 exists.
Other vulnerabilities in labstack echo
Sources
Also known as GHSA-pgvm-wxw2-hrv9, GO-2026-4502.