Vulnerability in Echo Go Framework Affects Static Middleware Functionality
CVE-2026-118655
5.9MEDIUM
What is CVE-2026-118655?
The Echo Go web framework contains a vulnerability in its static middleware function, middleware.Static. In certain versions prior to 4.15.3 and 5.2.0, this function is susceptible to improperly handling already decoded request paths. This allows for the reconstruction of double-encoded separators, potentially exposing files located under guarded routes when static middleware is globally registered. This behavior could lead to unauthorized access to sensitive files within the application's filesystem. Users are advised to upgrade to version 4.15.3 or 5.2.0 to mitigate this risk.
Affected Version(s)
echo >= 5.0.0, < 5.2.0 < 5.0.0, 5.2.0
echo < 4.15.3 < 4.15.3