CVE-2020-36565

CVE-2020-36565 corresponds to a directory-traversal vulnerability in the Windows environment within the static file handler of labstack/echo/v4. The root cause is improper sanitization of user input, allowing an attacker to read files outside the target directory that the server has permission to...

CVE-2026-25766

The CVE-2026-25766 issue affects Echo (github.com/labstack/echo/v5) on Windows, where middleware.Static uses the default filesystem and path.Clean does not treat backslashes as separators. This lets an unauthenticated attacker read files outside the static root by crafting a path that includes se...