CVE-2026-25891
Fiber has an Arbitrary File Read in Static Middleware on Windows
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.
| CWE | CWE-22 |
| Vendor | gofiber |
| Product | fiber |
| Published | Feb 24, 2026 |
| Last Updated | Feb 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for gofiber fiber
Be the first to know when new unknown vulnerabilities affecting gofiber fiber are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
gofiber / fiber
>= 3.0.0, < 3.1.0