Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-pgvm-wxw2-hrv9

Опубликовано: 17 фев. 2026
Источник: github
Github: Прошло ревью
CVSS3: 5.3

Описание

Echo has a Windows path traversal via backslash in middleware.Static default filesystem

Summary

On Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root.

Details

In middleware/static.go, the requested path is unescaped and normalized with path.Clean (URL semantics). path.Clean does not treat \ as a path separator, so ..\ sequences remain in the cleaned path. The resulting path is then passed to currentFS.Open(...). When the filesystem is left at the default (nil), Echo uses defaultFS which calls os.Open (echo.go:792). On Windows, os.Open treats \ as a path separator and resolves ..\, allowing traversal outside the static root.

Relevant code:

  • middleware/static.go (path unescape + path.Clean + currentFS.Open)
  • echo.go defaultFS.Openos.Open

This is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the path.Clean

  • defaultFS combination reintroduces the Windows backslash traversal.

PoC

Windows only.

Sample code (main.go):

package main import ( "log" "net/http" "github.com/labstack/echo/v5" "github.com/labstack/echo/v5/middleware" ) func main() { e := echo.New() // Important: use middleware.Static with default filesystem (nil) e.Use(middleware.Static("public")) e.GET("/healthz", func(c *echo.Context) error { return c.String(http.StatusOK, "ok") }) addr := ":1323" log.Printf("listening on %s", addr) if err := e.Start(addr); err != nil && err != http.ErrServerClosed { log.Fatal(err) } }

Static file:

public/index.html

(content can be any HTML)

Run: go run .

Verify:

curl http://localhost:1323/index.html curl --path-as-is "http://localhost:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts" Expected: 404

Screenshot: image image

Impact

Path traversal leading to arbitrary file read outside the static root. Any unauthenticated remote user can read local files that the Echo process has access to on Windows, if middleware.Static is used with the default filesystem.

Пакеты

Наименование

github.com/labstack/echo/v5

go
Затронутые версииВерсия исправления

>= 5.0.0, < 5.0.3

5.0.3

EPSS

Процентиль: 15%
0.00048
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVSS3: 5.3
ubuntu
около 1 месяца назад

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.

CVSS3: 5.3
nvd
около 1 месяца назад

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.

CVSS3: 5.3
debian
около 1 месяца назад

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows ...

EPSS

Процентиль: 15%
0.00048
Низкий

5.3 Medium

CVSS3

Дефекты

CWE-22