# Fiber has an Arbitrary File Read in Static Middleware on Windows

Fiber v3 static middleware sanitizer checks backslashes before URL-decoding, so double-encoded %255C becomes \ and path.Clean misses it, enabling arbitrary file read on Windows.

- Payout: Research
- Severity: high
- Program: Fiber
- Found by: wodzen
- Disclosed: 2026-02-24
- CVE: CVE-2026-25891
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-m3c2-496v-cw3v
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-m3c2-496v-cw3v
- Tags: area:oss domain:oss impact:data-leak kind:research platform:ghsa sev:high tech:go technique:parser-differential technique:source-review vuln:misconfiguration vuln:path-traversal

**Target:** static file-serving middleware (middleware/static/static.go sanitizePath)
**Root cause:** The backslash check runs before the URL-decode loop, so %255C passes the check then decodes to \; path.Clean only treats / as a separator, leaving ..\..\ sequences intact.
**Steps:**
1. Server runs Fiber v3 <=3.0.0 with static middleware on Windows.
2. Send a request path containing a double-encoded backslash traversal, e.g. `%255C..%255C..%255C` style sequences.
3. sanitizePath's initial `bytes.IndexByte(p, '\\')` check sees `%255C` and passes.
4. The decode loop unescapes `%255C` -> `%5C` -> `\`.
5. `path.Clean("/" + s)` does not treat `\` as a separator, so `..\..\` survives.
6. The cleaned path is used by the filesystem, which on Windows interprets `\` as a separator, traversing out of the web root.
**How found:** Code review of sanitizePath: noticed the backslash check precedes the decode loop (ordering bug) and that path.Clean is slash-only, so backslash traversal survives on Windows.
**Exploitation:** Remote attacker requests crafted double-encoded backslash traversal paths against a Windows-hosted Fiber static middleware to read arbitrary files within the server context, e.g. config files, source, or system files.
**Escalation:** Leaked application secrets/config may lead to further compromise.
**Insight:** When a sanitizer both blocks characters and decodes, check ordering: any blocklist applied before decoding can be bypassed by double-encoding. Also verify the path-cleaner's separator semantics match the target OS (path.Clean vs filepath.Clean on Windows).