CVE-2026-118655 | BDVDB-2026-397366 Detail
labstackecho
Description#
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-174 Double Decoding of the Same Data
References#
- https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
- https://github.com/labstack/echo/issues/2599
- https://github.com/labstack/echo/pull/3006
- https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
- https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
- https://github.com/labstack/echo/releases/tag/v4.15.3
- https://github.com/labstack/echo/releases/tag/v5.2.0
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.