15 matches found
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
CVE-2026-118650
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...
EUVD-2026-112461
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
CVE-2026-118655
The Echo Go web framework is vulnerable to a path traversal issue in versions prior to 4.15.3 and 5.2.0 . The middleware.Static component can perform a second decoding on an already decoded Request.URL.Path . This allows an attacker to use double-encoded separators to reconstruct restricted paths...
CVE-2026-118655 Echo: Static Middleware Double-Unescape Path Traversal
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware i...
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Summary When middleware.Static is mounted globally e.Usemiddleware.Static... and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the...
GHSA-375P-5QHX-8WQ4 Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Summary When middleware.Static is mounted globally e.Usemiddleware.Static... and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the...
EUVD-2026-112404
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...
CVE-2026-118650 Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...
CVE-2026-118650
The Echo Go web framework is vulnerable to a path bypass issue in versions prior to 4.16.0 and 5.4.0 . A globally mounted middleware.Static instance may interpret an encoded request path differently than the framework's router; specifically, the router matches the encoded path while the static ha...
PT-2026-129148
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...
CVE-2026-25766
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In middleware/static.go, the requested path is unescaped and...
CVE-2026-25766
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s "middleware.Static" using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In "middleware/static.go", the requested path is unescaped and...
CVE-2026-25766 Echo has a Windows path traversal via backslash in middleware.Static default filesystem
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In middleware/static.go, the requested path is unescaped and...
CVE-2026-25766: Improper Limitation of a Pathname to a Restricted Directory
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s middleware.Static using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In middleware/static.go, the requested path is unescaped and...