What’s Vulnerable › Vulnerabilities

CVE-2020-36565: Directory traversal on Windows in github.com/labstack/echo/v4

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-07 · updated 2026-06-17
• Weakness: CWE-22

Description

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.

Affected products

• labstack echo: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: labstack echo 4.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa
• https://github.com/labstack/echo/pull/1718
• https://pkg.go.dev/vuln/GO-2021-0051
• https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa
• https://github.com/labstack/echo/pull/1718
• https://pkg.go.dev/vuln/GO-2021-0051

Get alerted when CVE-2020-36565 or the next vulnerability affects your stack