Echo has a Static Middleware Double-Unescape Path Traversal
Impact
Commit a9ede66a (PR 3006, issue 2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware.
Source excerpt · OSVWhat to do
Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 5.2.0Semantic versions | 5.2.0 |
Version evidence: OSV · GHSA-xwq5-6cqp-vx96
View original version evidence (0 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.15.3Semantic versions | 4.15.3 |
Version evidence: OSV · GHSA-xwq5-6cqp-vx96
View original version evidence (0 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
labstack · GitHub_M
echo
2 ranges
labstack · GitHub_M
echo
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 5.0.0, < 5.2.0
< 4.15.3
Other versions: unknown
Original source description
Summary
Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware.
Vulnerability
The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again:
// BEFORE (vulnerable)
pathUnescape := true
This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt.
Fix
// AFTER (fixed)
pathUnescape := false
The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked.
Impact
Arbitrary file read from server filesystem via percent-encoded path traversal.
References
- Fix: https://github.com/labstack/echo/commit/a9ede66a
- Issue: https://github.com/labstack/echo/issues/2599
- PR: https://github.com/labstack/echo/pull/3006
Patches
Fixed in github.com/labstack/echo/v5 v5.2.0 and github.com/labstack/echo/v4 v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (%252F) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths.
Workarounds
Keep files that need protection outside the Static middleware's root directory.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-118655View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-118655
Observed 2026-10-29T18:49:09.647Z · upstream updated 2026-10-29T18:29:50.622Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T18:29:35.386733Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.