{"answers":{"affected":"3 open source packages ship an affected version, including github.com/labstack/echo/v5. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25766 exists.","fix":"Upgrade github.com/labstack/echo/v5 to 5.0.3 or later.","what":"CVE-2026-25766 is a medium-severity path traversal vulnerability in labstack echo, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-25766 and fix it if it is affected.\n\nWhat it is: CVE-2026-25766 is a medium-severity path traversal vulnerability in labstack echo, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25766 exists.\n\nAffected packages and fixed versions:\n- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3\n- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3\n- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-25766/ (Markdown: https://insights.sbomify.com/CVE-2026-25766/index.md)","id":"CVE-2026-25766","markdown":"https://insights.sbomify.com/CVE-2026-25766/index.md","name":"CVE-2026-25766","record":{"aliases":["GHSA-pgvm-wxw2-hrv9","GO-2026-4502"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Go web framework","requires_auth":"none","summary":"An attacker can read arbitrary files outside the static root on Windows by exploiting backslash path traversal in the Echo framework's static middleware.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"echo","vendor":"labstack"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\\` as a path separator, so `..\\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\\` as a path separator and resolves `..\\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Echo has a Windows path traversal via backslash in middleware.Static default filesystem","id":"CVE-2026-25766","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"LavinMQ has incomplete shovel configuration validation","id":"CVE-2026-25767"},"packages":[{"ecosystem":"Go","fixed":["5.0.3"],"introduced":["5.0.0"],"last_affected":[],"package":"github.com/labstack/echo/v5","purl":null,"source":"GHSA-pgvm-wxw2-hrv9"},{"ecosystem":"Go","fixed":["5.0.3"],"introduced":["5.0.0"],"last_affected":[],"package":"github.com/labstack/echo/v5","purl":"pkg:golang/github.com/labstack/echo/v5","source":"GHSA-pgvm-wxw2-hrv9"},{"ecosystem":"Go","fixed":["5.0.3"],"introduced":["5.0.0"],"last_affected":[],"package":"github.com/labstack/echo/v5","purl":"pkg:golang/github.com/labstack/echo/v5","source":"GO-2026-4502"}],"prev":{"headline":"Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url","id":"CVE-2026-25765"},"products":["echo"],"published":"2026-02-19","related":[{"cvss_score":9.6,"headline":"Labstack Echo Open Redirect vulnerability","id":"CVE-2022-40083","kev_date_added":null,"published":"2022-09-28"},{"cvss_score":5.3,"headline":"Directory traversal on Windows in github.com/labstack/echo/v4","id":"CVE-2020-36565","kev_date_added":null,"published":"2022-12-07"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-19","vendors":["labstack"]},"summary":"An attacker can read arbitrary files outside the static root on Windows by exploiting backslash path traversal in the Echo framework's static middleware.","url":"https://insights.sbomify.com/CVE-2026-25766/"}