CVE-2026-25891CWE-22

Fiber has an Arbitrary File Read in Static Middleware on Windows

High · published February 24, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00773 · 55.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-24T21:08Z
EPSS history
Timeline
  • 24 FEB 21:08Z
    Fiber has an Arbitrary File Read in Static Middleware on Windows
    cvelistv5