Path Traversal Vulnerability in Fiber Web Framework for Go

CVE-2026-25891

What is CVE-2026-25891?

A Path Traversal vulnerability in the Fiber web framework, an Express-inspired framework written in Go, enables a remote attacker to bypass the static middleware sanitizer. This flaw permits access to arbitrary files on the server file system, particularly impacting users on Windows operating systems. Versions from Fiber v3 to v3.0.0 are vulnerable, but this issue has been addressed in Fiber v3.1.0. It highlights the importance of keeping web frameworks updated to safeguard against unauthorized file access.

References