# CVE-2026-25766: Echo has a Windows path traversal via backslash in middleware.Static default filesystem

> An attacker can read arbitrary files outside the static root on Windows by exploiting backslash path traversal in the Echo framework's static middleware.

- **Severity:** Medium 5.3 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Feb 2026
- **Updated:** 19 Feb 2026
- **Also known as:** GHSA-pgvm-wxw2-hrv9, GO-2026-4502

## What is CVE-2026-25766?

CVE-2026-25766 is a medium-severity path traversal vulnerability in labstack echo, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.

Weakness: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)

## Which versions are affected by CVE-2026-25766?

3 open source packages ship an affected version, including github.com/labstack/echo/v5. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `github.com/labstack/echo/v5` | Go | From 5.0.0 | 5.0.3 |
| `github.com/labstack/echo/v5` | Go | From 5.0.0 | 5.0.3 |
| `github.com/labstack/echo/v5` | Go | From 5.0.0 | 5.0.3 |

Products: Labstack Echo.

## How do I fix CVE-2026-25766?

Upgrade github.com/labstack/echo/v5 to 5.0.3 or later.

## Is CVE-2026-25766 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25766 exists.

## Other vulnerabilities in labstack echo

- [CVE-2022-40083](https://insights.sbomify.com/CVE-2022-40083/): Labstack Echo Open Redirect vulnerability (critical 9.6)
- [CVE-2020-36565](https://insights.sbomify.com/CVE-2020-36565/): Directory traversal on Windows in github.com/labstack/echo/v4 (medium 5.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-25766 and fix it if it is affected.

What it is: CVE-2026-25766 is a medium-severity path traversal vulnerability in labstack echo, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25766 exists.

Affected packages and fixed versions:
- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3
- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3
- github.com/labstack/echo/v5 (Go): affected from 5.0.0; fixed in 5.0.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-25766/ (Markdown: https://insights.sbomify.com/CVE-2026-25766/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-25766
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-25766
- OSV: https://osv.dev/vulnerability/CVE-2026-25766

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-25766/
Summaries are generated and may contain mistakes; the official description above is the record.