GO-2026-4502 Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5...

ECHO-1291-4784-C718

Bulletin has no description...

ECHO-3601-998E-3D53

Bulletin has no description...

ECHO-15FF-770A-3861

Bulletin has no description...

ECHO-4DEB-6F40-7871

Bulletin has no description...

ECHO-47E1-8FA8-B833

Bulletin has no description...

ECHO-0257-4D24-10D2

Bulletin has no description...

ECHO-1A7D-AFEC-31FD

Bulletin has no description...

ECHO-BAA9-B0DD-7FD5

Bulletin has no description...

ECHO-0C56-39D9-33DE

Bulletin has no description...

ECHO-7194-1339-FD86

Bulletin has no description...

ECHO-8502-3F7F-E2B6

Bulletin has no description...

ECHO-C980-C6BE-2403

Bulletin has no description...

ECHO-CF84-736A-7911

Bulletin has no description...

ECHO-400A-DE0A-4538

Bulletin has no description...

ECHO-1935-6289-C67C

Bulletin has no description...

📄 Echo Framework 5.0.4 Path Traversal

This Python script is a security testing tool designed to detect a path traversal vulnerability in web applications built with the Echo framework version 5 running on Windows systems...

CVE-2026-25766

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In middleware/static.go, the requested path is unescaped and...

CVE-2026-25766

Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In middleware/static.go, the requested path is unescaped and...

CVE-2026-25766

The CVE-2026-25766 issue affects Echo (github.com/labstack/echo/v5) on Windows, where middleware.Static uses the default filesystem and path.Clean does not treat backslashes as separators. This lets an unauthenticated attacker read files outside the static root by crafting a path that includes se...