CVE-2026-25891

HIGH EPSS 45.1%
Published Feb 24, 20264mo ago · Modified Jun 17, 20261w ago
7.7 CVSS 4.0
High
Find Similar
Published Feb 24, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.

CVSS Details

Base Score
7.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
45.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
gofiberfiber*≥3.0.0  –  <3.1.0

References 3

  • github.com https://github.com/gofiber/fiber/commit/59133702301c2ab7b776dd123b474cbd995f2c86
    Patch
  • github.com https://github.com/gofiber/fiber/pull/4064
    ExploitIssue Tracking
  • github.com https://github.com/gofiber/fiber/security/advisories/GHSA-m3c2-496v-cw3v
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/gofiber/fiber/commit/59133702301c2ab7b776dd123b474cbd995f2c86
    Patch