CVE-2026-25891

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25891
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25891.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25891
Aliases
Downstream
Related
Published
2026-02-24T21:08:48.675Z
Modified
2026-03-04T22:28:58.641544Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Fiber has an Arbitrary File Read in Static Middleware on Windows
Details

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25891.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/gofiber/fiber

Affected ranges

Type
GIT
Repo
https://github.com/gofiber/fiber
Events
Introduced
f8f34f642fb3682c341ede7816e7cf861aa7df89
Fixed
3c24ebefe5009e88f9f9258b472e8021160179bf

Affected versions

v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25891.json"