CVE-2020-36565: 
NixOS vulnerability analysis and mitigation

Due to improper sanitization of user input on Windows, the static file handler in github.com/labstack/echo/v4 (versions before v4.1.18-0.20201215153152-4422e3b66b9f) allows for directory traversal, enabling attackers to read files outside of the target directory that the server has permission to read (NVD, Go Vuln DB).

The vulnerability exists in the static file handler's path handling mechanism. The issue stems from using path.Clean() instead of filepath.Clean() for path sanitization. While path.Clean() only handles forward slashes, filepath.Clean() properly handles OS-specific separators, including backslashes on Windows. This allowed attackers to use backslash-based path traversal (..) to access files outside the intended directory on Windows systems (Echo PR).

An attacker can exploit this vulnerability to read files outside of the target directory that the server has permission to access. This could potentially lead to unauthorized access to sensitive files on Windows systems where the Echo framework is deployed (Go Vuln DB).

The issue was fixed by replacing path.Clean() with filepath.Clean() to properly handle OS-specific path separators. Users should upgrade to Echo version v4.1.18-0.20201215153152-4422e3b66b9f or later to receive the security fix (Echo Commit).