CVE-2026-25891
published 2026-02-24CVE-2026-25891: Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.62%
45.1th percentile
Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | gofiber_fiber_v3 | >= 0 < 3.1.0 | 3.1.0 |
| gofiber | fiber | — | — |
| gofiber | fiber | >= 3.0.0 < 3.1.0 | 3.1.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
osv·2026-02-26
CVE-2026-25891 Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3
GHSA
Fiber has an Arbitrary File Read in Static Middleware on Windows
ghsa·2026-02-24
CVE-2026-25891 [HIGH] CWE-22 Fiber has an Arbitrary File Read in Static Middleware on Windows
Fiber has an Arbitrary File Read in Static Middleware on Windows
### Summary
**Description**
A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.
### Details
The vulnerability resides in `middleware/static/static.go` within the `sanitizePath` function. This function attempts to sanitize the requested path by checking for backslashes, decoding the URL, and then cleaning the path.
The vulnerability stems from two combined issues:
- The check for backslash characters happens before the URL decoding loop. If an attacker sends a double-encoded backslash, the initial check se
OSV
Fiber has an Arbitrary File Read in Static Middleware on Windows
osv·2026-02-24
CVE-2026-25891 [HIGH] Fiber has an Arbitrary File Read in Static Middleware on Windows
Fiber has an Arbitrary File Read in Static Middleware on Windows
### Summary
**Description**
A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.
### Details
The vulnerability resides in `middleware/static/static.go` within the `sanitizePath` function. This function attempts to sanitize the requested path by checking for backslashes, decoding the URL, and then cleaning the path.
The vulnerability stems from two combined issues:
- The check for backslash characters happens before the URL decoding loop. If an attacker sends a double-encoded backslash, the initial check se
No detection rules found.
No public exploits indexed.
2026-02-24
Published