CVE-2026-25766

CVE-2026-25766 is a path traversal vulnerability affecting Echo web framework versions 5.0.0 through 5.0.2 when running on Windows with the default filesystem. An unauthenticated attacker can exploit this by using backslashes in URLs to read arbitrary files outside the static root. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity and no user interaction required, with potential for sensitive information disclosure. There is currently no evidence of active exploitation, nor are there public exploits available in Metasploit, Nuclei, or ExploitDB, though it has garnered some community discussion and media coverage.