Vulnerability · Published Dec 7, 2022 · Assigned by Go
CVE-2020-36565Directory traversal on Windows in github.com/labstack/echo/v4
Medium 5.3
In plain English
A medium-severity security flaw in github.com/labstack/echo/v4 from github.com/labstack/echo/v4. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/labstack/echo/v4 | 4.2.0 | GHSA-j453-hm5x-c46w |
| Go | github.com/labstack/echo/v4 | 4.1.18-0.20201215153152-4422e3b66b9f | GO-2021-0051 |
| Ubuntu:22.04:LTS | golang-github-labstack-echo | no fix listed | UBUNTU-CVE-2020-36565 |
| Ubuntu:24.04:LTS | golang-github-labstack-echo | no fix listed | UBUNTU-CVE-2020-36565 |
| Ubuntu:25.10 | golang-github-labstack-echo | no fix listed | UBUNTU-CVE-2020-36565 |
| Ubuntu:26.04:LTS | golang-github-labstack-echo | no fix listed | UBUNTU-CVE-2020-36565 |
| Ubuntu:26.10 | golang-github-labstack-echo | no fix listed | UBUNTU-CVE-2020-36565 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| github.com/labstack/echo/v4 | github.com/labstack/echo/v4 | 0 – before 4.1.18-0.20201215153152-4422e3b66b9f |