CVE-2026-118655GHSA-xwq5-6cqp-vx96
Echo: Static Middleware Double-Unescape Path Traversal
labstack echo
CVSS
5.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Text from CVE List
Affected versions 2
- echoaffected: >= 5.0.0, < 5.2.0CVE List
- echoaffected: < 4.15.3CVE List
References 7
- github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6Fixvia CVE List
- github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725Fixvia CVE List
- github.com/labstack/echo/releases/tag/v4.15.3Fixvia CVE List
- github.com/labstack/echo/releases/tag/v5.2.0Fixvia CVE List
- github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96Advisoryvia CVE List
- github.com/labstack/echo/issues/2599Referencevia CVE List
- github.com/labstack/echo/pull/3006Referencevia CVE List