GO-2026-4502
NoneCVSS
—
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/labstack/echo/v5 | 5.0.0 | 5.0.3 |