CVE-2026-25891: Arbitrary File Read in Fiber Static Middleware on Windows
Summary
CVE-2026-25891: Fiber has an Arbitrary File Read in Static Middleware on Windows in github.com/gofiber/fiber/v3. Affects github.com/gofiber/fiber/v3 versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fiber is a web framework for Go that is designed to be fast and efficient, providing a robust set of features for building web applications. It includes middleware for handling static files, which allows developers to serve files from a specified directory. However, a vulnerability has been identified in the static middleware on Windows systems, which could lead to unauthorized file access.
Vulnerability Detail
The vulnerability arises from an Arbitrary File Read in the Static Middleware of Fiber, specifically in version 3 of the package. This issue allows an attacker to read files from the server's file system that should not be accessible, potentially exposing sensitive information. The vulnerability is particularly concerning on Windows systems, where file path handling may differ from other operating systems. If exploited, this could lead to data breaches or unauthorized access to critical files.
How To Fix
Latest published version: v3.6.1 as of 22 Oct 2026
go get github.com/gofiber/fiber/v3@v3.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
go get github.com/gofiber/fiber/v3@v3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive files by configuring your server to deny requests for certain file types or paths. Additionally, ensure that your application does not expose any directories that contain sensitive information.
Conclusion
The CVE-2026-25891 vulnerability in the Fiber package poses a significant risk to applications running on Windows due to arbitrary file read capabilities. It is crucial for developers to update to version 3.1.0 or later to mitigate this risk and to consider implementing additional security measures in their applications.
See every vulnerability recorded for github.com/gofiber/fiber/v3 →
FAQ
The vulnerability allows for arbitrary file reading, meaning an attacker can access files on the server that should be protected.
Versions prior to 3.1.0 of the Fiber package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive files, resulting in data breaches or exposure of confidential information.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gofiber/fiber/v3.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.