What is the CVSS score of CVE-2026-25891?

CVE-2026-25891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-25891?

A path traversal vulnerability in Fiber web framework allows attackers to read arbitrary files on Windows servers, potentially exposing sensitive data such as credentials, source code, and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25891?

Yes, a public proof-of-concept exploit is available for CVE-2026-25891. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25891?

Within 24 hours: Inventory all applications using Fiber framework and identify Windows deployments; assess whether static middleware is enabled. Within 7 days: Apply available patch to all affected systems and validate in staging environment. Within 30 days: Complete patch deployment across all production environments and conduct file access audit to detect prior exploitation attempts.

Windows CVE-2026-25891

HIGH

Path Traversal (CWE-22)

2026-02-24 security-advisories@github.com

GHSA-m3c2-496v-cw3v

Windows Path Traversal Fiber Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 03:18 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 03:18 nvd

Patch available

CVE Published

Feb 24, 2026 - 22:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.

AnalysisAI

Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote attackers to bypass static file middleware protections and read arbitrary files from the server. Public exploit code exists for this vulnerability, which affects applications using the vulnerable Fiber versions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious path traversal request

Exploit

Bypass static middleware sanitizer

Execution

Access file system outside intended directory

Impact

Read arbitrary files on Windows server

Access

Craft malicious path traversal request

Exploit

Bypass static middleware sanitizer

Execution

Access file system outside intended directory

Impact

Read arbitrary files on Windows server

Vulnerability AssessmentAI

Exploitation	Fiber v3.0.0 or earlier with static middleware enabled serving files on Windows. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.5 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all applications using Fiber framework and identify Windows deployments; assess whether static middleware is enabled. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-12440 CRITICAL Act Now

9.6 Jun 17

Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to po

CVE-2026-12437 HIGH This Week

8.3 Jun 17

Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had comprom

CVE-2026-12449 HIGH This Week

7.8 Jun 17

Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-

CVE-2026-12461 MEDIUM This Month

6.5 Jun 17

Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain pot

CVE-2026-12444 MEDIUM This Month

5.5 Jun 17

Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-25891 vulnerability details – vuln.today

Back

Windows CVE-2026-25891

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code