{"id":"CVE-2026-25891","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-25891","generatedAt":"2026-10-28T03:31:44.813Z","title":"A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows.","description":"Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.","published":"2026-02-24T22:16:31.000Z","lastModified":"2026-06-17T10:25:23.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":7.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":["gofiber/fiber"],"epss":{"score":0.00703,"percentile":0.53016,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/gofiber/fiber/commit/59133702301c2ab7b776dd123b474cbd995f2c86","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/gofiber/fiber/pull/4064","tags":["Exploit","Issue Tracking"],"source":"security-advisories@github.com"},{"url":"https://github.com/gofiber/fiber/security/advisories/GHSA-m3c2-496v-cw3v","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-25891","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}