Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118654 · GHSA-3pmx-cf9f-34xr

Echo static file middleware route protection bypass via encoded dot-dot traversal

Risk score
45/100
CVSS
5.9 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an applicat…
Affected
github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0
Fix
Upgrade github.com/labstack/echo/v5 to 5.4.0; github.com/labstack/echo/v4 to 4.16.0 or later.
Exploitation
Public proof of concept

Story map

Story map: github.com/labstack/echo/v5THE FLAWSTHE FIXCVE-2026-118654Echo static file middlewareroute protection bypass viaencoded dot-dot traversalCVSS 5.9CVE-2026-118650Echo's middleware.Static:`%2F`-encoded path bypassesroute/group middleware…CVSS 7.5CVE-2026-118656Echo has Open Redirect viaControl-Character PrefixDefeating sanitizeURICVSS 6.1CVE-2026-118657Echo: HTTPS Redirect and HSTSBypass via Unconditional Trustof Forwarded Scheme HeadersCVSS 5.9Upgrade…4.16.0 · 5.4.0or later on your release lineWho is exposedgithub.com/labstack/echo/v5(go) < 5.4.0;github.com/labstack/echo/v4(go) < 4.16.0YELLOW · PLAN IT INgithub.com/labstack/echo/v5Echo is a Go web framework.Prior to 4.16.0 and 5.4.0, aglobally mountedmiddleware.Static instance caninterpret an encoded requestpath differently from Echo'srouter because the router…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

  • CVE-2026-118654: Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9)
  • CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
  • CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
  • CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/labstack/echo/v5go< 5.4.05.4.0
github.com/labstack/echo/v4go< 4.16.04.16.0

References

Original description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.