CVE catalog
CVE-2026-25766
golang-github-labstack-echo: CVE-2026-25766
- Severity
- Medium
- Source
- [NVD] · [CVE record]
- EPSS
- 0.38% · Oct 25, 2026
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-github-labstack-echo | sid | 4.12.0-1 | not affected |
| Debian | golang-github-labstack-echo | forky | 4.12.0-1 | not affected |
| Debian | golang-github-labstack-echo | trixie | 4.12.0-1 | not affected |
| Debian | golang-github-labstack-echo | bookworm | 4.2.1-3 | not affected |
| Go | github.com/labstack/echo/v5 | Not reported | 5.0.3 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-github-labstack-echo | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-labstack-echo | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-labstack-echo | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | golang-github-labstack-echo | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Go | github.com/labstack/echo/v5 | Go | Not reported | 5.0.3 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.