CVE-2026-25766: 
NixOS vulnerability analysis and mitigation

CVE-2026-25766 is a path traversal vulnerability (CWE-22) in the Echo Go web framework's middleware.Static component that allows unauthenticated remote attackers to read arbitrary files outside the configured static root directory on Windows systems. It affects Echo versions 5.0.0 through 5.0.2 (Go module github.com/labstack/echo/v5) and was disclosed on February 17, 2026, with a patch released in version 5.0.3. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Echo Security Advisory).

The root cause is an inconsistency between how Go's path.Clean (which uses URL/POSIX semantics and does not treat \ as a path separator) normalizes request paths and how Windows' os.Open resolves those same paths. In middleware/static.go, the requested URL path is unescaped and passed through path.Clean, which leaves ..\ sequences intact because it does not recognize backslash as a separator. The cleaned path is then passed to currentFS.Open(...), and when middleware.StaticConfig.Filesystem is nil (the default), Echo's defaultFS calls os.Open directly — which on Windows treats \ as a path separator and resolves ..\ traversal sequences, allowing access outside the static root. This is a regression of the same class of bug as CVE-2020-36565 (fixed in Echo v4 by switching to OS-aware path cleaning), reintroduced in v5 by the path.Clean + defaultFS combination. Exploitation requires only that the application uses middleware.Static with the default filesystem (nil) on a Windows host (GitHub Advisory, Echo Security Advisory).

Successful exploitation allows any unauthenticated remote attacker to read arbitrary files accessible to the Echo process on the Windows host, limited to the process's working directory and its subfolders. This can expose sensitive data including configuration files, private keys, source code, and other confidential application data. There is no integrity or availability impact; the vulnerability is purely a confidentiality risk (GitHub Advisory, Echo Security Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating file read via URL-encoded backslash traversal sequences (e.g., ..%5c..%5c). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.049% (0.000490), indicating a low near-term exploitation probability (GitHub Advisory, Echo Security Advisory).

1. Identify target: Locate a Windows server running an Echo v5 application (versions 5.0.0–5.0.2) that uses middleware.Static with the default filesystem (i.e., middleware.StaticConfig.Filesystem is nil).
2. Confirm vulnerability: Send a normal request (e.g., curl http://target:1323/index.html) to verify the static middleware is active and serving files.
3. Craft traversal payload: Construct a URL using URL-encoded backslashes (%5c) to represent ..\ sequences, bypassing path.Clean's normalization. For example, to read the Windows hosts file: http://target:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts
4. Send request with path-as-is flag: Use curl --path-as-is to prevent the HTTP client from normalizing the path before sending: curl --path-as-is "http://target:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts"
5. Read arbitrary files: The server's os.Open resolves the backslash sequences on Windows, returning the contents of the requested file outside the static root. Repeat with different paths to enumerate sensitive files (e.g., application config files, .env files, private keys) accessible to the Echo process (GitHub Advisory, Echo Security Advisory).

• Network: HTTP GET requests to the Echo application containing URL-encoded backslash sequences (%5c) combined with .. traversal patterns (e.g., ..%5c..%5c) in the request path; requests using --path-as-is behavior that preserve encoded characters without normalization.
• Logs: Web server/application access logs showing requests with patterns like /%2e%2e%5c, /..%5c, or multiple %5c segments in the URL path, especially targeting paths outside the configured static root (e.g., Windows/System32, application config directories).
• File System: No direct file system artifacts are created by read-only exploitation; however, unexpected access to files outside the static root directory (e.g., hosts, .env, config.yaml, private key files) may be observable in OS-level file access auditing if enabled.
• Process: No unusual child processes are expected, as exploitation is limited to file reads via the existing Echo process (GitHub Advisory).

The primary remediation is to upgrade Echo to version 5.0.3 or later, which fixes the issue by replacing the os.Open-based defaultFS with os.DirFS(dir) (which uses fs.FS semantics and does not resolve Windows backslashes as path separators). For organizations unable to patch immediately, implement network-level controls to restrict access to affected middleware.Static endpoints, and apply the principle of least privilege to the Echo process's file system permissions to limit the scope of any potential file disclosure. Explicitly setting a custom middleware.StaticConfig.Filesystem (non-nil) also avoids the vulnerable defaultFS code path (Echo Security Advisory, Patch Commit).

The vulnerability was reported by researcher shblue21 and remediated by Echo contributor aldas, who noted in the pull request that the regression was introduced in the initial v5 proposal branch around October 2021 and that existing tests failed to catch it because they used a custom filesystem rather than the default one. Contributor shblue21 publicly thanked the maintainers for their prompt response and transparency. The fix was merged on February 6, 2026, and the advisory was published February 17, 2026 (Echo PR #2891, GitHub Advisory).