Fiber implements an Express‑style static file middleware that is supposed to block path traversal. However, a flaw in the sanitizer allows a remote attacker to craft a request that escapes the intended directory, enabling reads of any file on the server’s file system. The flaw maps to CWE‑22 and compromises confidentiality by exposing sensitive data, configuration files, or credentials without authentication.

The vulnerability exists in all Fiber releases from v3 up to and including v3.0.0. It has been resolved in Fiber v3.1.0. Users running the affected versions on Windows servers are at risk.

The CVSS score of 7.7 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently very rare. The issue is not listed in CISA’s KEV catalog. Attackers can exploit it remotely through a crafted HTTP request to the static middleware endpoint, bypassing the intended sanitization logic. No additional user interaction or privileged access is required.