Directory Traversal in Echo Web Framework Affects LabStack
CVE-2026-118654
5.9MEDIUM
What is CVE-2026-118654?
The Echo web framework, developed by LabStack, has a directory traversal vulnerability that allows unauthenticated attackers to read sensitive files. This occurs when the static file handlers normalize dot segments after route matching, potentially exposing files intended to be protected by route-level middleware. This vulnerability stems from an incomplete fix for a prior issue and affects versions prior to 4.16.0 and 5.4.0. Users are advised to upgrade to the latest versions to mitigate this security risk.
Affected Version(s)
echo < 4.16.0 < 4.16.0
echo >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0