PT-2026-20330 · Echo · Echo

Shblue21 · Published 2026-02-17 · Updated 2026-03-03 · CVE-2026-25766

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Echo versions 5.0.0 through 5.0.2

Description Echo, a Go web framework, has an issue where the middleware.Static component, when used with the default filesystem on Windows, allows path traversal through backslashes. This enables unauthenticated remote file read outside the designated static root. The requested path is processed using path.Clean, which does not recognize backslashes as path separators, leaving .. sequences intact. Subsequently, os.Open on Windows interprets these backslashes as separators, enabling traversal beyond the intended static root. The middleware/static.go file and the echo.go file are relevant to this issue.

Recommendations Update to Echo version 5.0.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-25766

GHSA-PGVM-WXW2-HRV9

GO-2026-4502

SUSE-SU-2026:0757-1

Affected Products

Echo

References · 120

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25766.json · Exploit
• https://github.com/labstack/echo/pull/2891 · Patch
• https://github.com/labstack/echo/commit/b1d443086ea27cf51345ec72a71e9b7e9d9ce5f1 · Patch
• https://github.com/labstack/echo/security/advisories/GHSA-pgvm-wxw2-hrv9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25766 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25766 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4502 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pgvm-wxw2-hrv9 · Vendor Advisory
• https://github.com/labstack/echo · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note
• https://suse.com/security/cve/CVE-2025-14435 · Note
• https://suse.com/security/cve/CVE-2026-21435 · Note
• https://suse.com/security/cve/CVE-2017-18916 · Note
• https://suse.com/security/cve/CVE-2026-24894 · Note