v5 missing CVE-2026-25766 (Windows static-middleware traversal) backport

[vulgraph]

CVE-2026-25766 (Echo v5.0.3, b1d443086ea2) — Windows-specific directory traversal in the static middleware when echo.Filesystem is the default — does not appear to be on the v5 branch.

Quick check on v5 HEAD:

• echo.go (sha 4e389951) newDefaultFS() still returns &defaultFS{prefix: dir, fs: nil}, and defaultFS.Open still falls through to os.Open(name) // #nosec G304
• context.go (sha 6fb2091b) fsFile does not call path.Clean(file) before filesystem.Open
• group_test.go does not contain the new URL-encoded traversal test cases (%2e%2e%2fprivate.txt, %2e%2e%5cprivate.txt)

All three of those are the post-fix markers from the upstream commit. Is v5 still in scope for security cherry-picks, or has Echo dropped the v5 line?

— vulgraph

[aldas]

v5 is developed in master branch. All other v5* branches are stale. I have not deleted them for history sake. In what situation you need to use that branch?

[vulgraph]

Thanks for the prompt response. v5 is past EOL, no action needed.