Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118655 · GHSA-xwq5-6cqp-vx96

Echo has a Static Middleware Double-Unescape Path Traversal

Risk score
40/100
CVSS
5.9 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally.…
Affected
github.com/labstack/echo/v5 (go) < 5.2.0; github.com/labstack/echo/v4 (go) < 4.15.3
Fix
Upgrade github.com/labstack/echo/v5 to 5.2.0; github.com/labstack/echo/v4 to 4.15.3 or later.
Exploitation
No known exploitation

Story map

Story map: github.com/labstack/echo/v5THE FLAWSTHE FIXCVE-2026-118655Echo has a Static MiddlewareDouble-Unescape PathTraversalCVSS 5.9CVE-2026-118650Echo's middleware.Static:`%2F`-encoded path bypassesroute/group middleware…CVSS 7.5CVE-2026-118656Echo has Open Redirect viaControl-Character PrefixDefeating sanitizeURICVSS 6.1CVE-2026-118657Echo: HTTPS Redirect and HSTSBypass via Unconditional Trustof Forwarded Scheme HeadersCVSS 5.9Upgrade…4.15.3 · 5.2.0 · 4.16.0 · 5.4.0or later on your release lineWho is exposedgithub.com/labstack/echo/v5(go) < 5.4.0;github.com/labstack/echo/v4(go) < 4.16.0YELLOW · PLAN IT INgithub.com/labstack/echo/v5Echo is a Go web framework.Prior to 4.16.0 and 5.4.0, aglobally mountedmiddleware.Static instance caninterpret an encoded requestpath differently from Echo'srouter because the router…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-174 (CWE-174)2 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

  • CVE-2026-118655: Echo has a Static Middleware Double-Unescape Path Traversal (CVSS 5.9)
  • CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
  • CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
  • CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.15.3 · 5.2.0 · 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/labstack/echo/v5go< 5.2.05.2.0
github.com/labstack/echo/v4go< 4.15.34.15.3

References

Original description

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.