PT-2026-21802 · Fiber · Fiber
Wodzen
·
Published
2026-02-24
·
Updated
2026-03-03
·
CVE-2026-25891
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Fiber versions 3.0.0 and earlier
Fiber versions 3.0.0 through 3.0.0
Description
A Path Traversal flaw exists in Fiber, potentially allowing a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. The issue stems from a combination of factors: a check for backslash characters occurring before URL decoding, and the use of
path.Clean, which is designed for slash-separated paths and does not recognize backslashes as directory separators. This allows attackers to traverse up the directory tree using sequences like ..... The vulnerable code resides in the sanitizePath function within middleware/static/static.go. Exploitation allows directory traversal on the host server, potentially enabling attackers to access sensitive files, including configuration files, source code, and system files.Recommendations
Update to Fiber version 3.1.0 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fiber