Path Traversal Vulnerability in Echo Go Framework on Windows

CVE-2026-25766

What is CVE-2026-25766?

The Echo Go Framework, versions 5.0.0 through 5.0.2 on Windows, contains a vulnerability in its middleware.Static functionality. This flaw allows for path traversal attacks via backslashes, which can enable unauthenticated remote file reading outside of the designated static root. The issue arises because the method used to clean and normalize the requested path does not adequately handle backslash characters. Consequently, the vulnerability can facilitate unauthorized access to the filesystem when the default filesystem settings are in use. This flaw has been rectified in version 5.0.3 of the framework.

References