Live › vulnerability › CVE-2026-118655
Go to dashboardEcho's middleware.Static decodes the request path a second time, so double-encoded path separators can be rebuilt before the filesystem lookup. An attacker can reach files under a route that is supposed to be guarded when the static middleware is registered globally.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 20:35 UTC. All times on this page are UTC.
Applications that serve files with Echo's static middleware and register it globally, so it runs before route-level access checks on other paths. Apps that mount static middleware only on a specific group or that serve no files from disk are unlikely to be exposed. Teams that do not use middleware.Static can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/labstack/echo/v5 | go | < 5.2.0 | 5.2.0 |
| github.com/labstack/echo/v4 | go | < 4.15.3 | 4.15.3 |
grep labstack/echo go.mod; versions before 4.15.3 and 5.2.0 are affected.middleware.Static registered with e.Use(...) at the top level, which applies it to all routes.github.com/labstack/echo/v4 to 4.15.3 or later.github.com/labstack/echo/v5 to 5.2.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware.
The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again:
// BEFORE (vulnerable)
pathUnescape := true
This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt.
// AFTER (fixed)
pathUnescape := false
The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked.
Arbitrary file read from server filesystem via percent-encoded path traversal.
Fixed in github.com/labstack/echo/v5 v5.2.0 and github.com/labstack/echo/v4 v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (%252F) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths.
Keep files that need protection outside the Static middleware's root directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-118655")
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.