CVE-2026-25891: Fiber Package Arbitrary File Read Vulnerability on Windows
Summary
CVE-2026-25891: Fiber has an Arbitrary File Read in Static Middleware on Windows. Affects github.com/gofiber/fiber/v3 versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fiber is a web framework for Go that is designed to be fast and efficient, providing developers with a simple API for building web applications. It supports middleware, routing, and various features that enhance web server performance. However, a vulnerability in its static middleware allows for arbitrary file reading on Windows systems, which can lead to serious security issues.
Vulnerability Detail
A Path Traversal vulnerability (CWE-22) exists in Fiber's static middleware, allowing remote attackers to bypass sanitization and read arbitrary files on the server's file system on Windows. The vulnerability arises from improper handling of backslashes and URL decoding in the sanitizePath function. Attackers can exploit this flaw to traverse the directory tree and access sensitive files, potentially leading to further compromises.
How To Fix
Latest published version: v3.6.1 as of 22 Oct 2026
go get github.com/gofiber/fiber/v3@v3.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
go get github.com/gofiber/fiber/v3@v3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the static middleware on Windows systems until the package is updated. Additionally, ensure that sensitive files are not accessible through the web server's document root.
Conclusion
The CVE-2026-25891 vulnerability in the Fiber package poses a significant risk to applications running on Windows due to its ability to allow arbitrary file reading. Users should promptly update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for github.com/gofiber/fiber/v3 →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Fiber versions from 3.0.0 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Successful exploitation can allow attackers to read sensitive files, such as configuration files and source code, which may lead to further security breaches.
Yes, a patch is available in Fiber version 3.1.0 and later. Users are strongly encouraged to update to this version.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber/v3.
