URL Path Decoding Vulnerability in Echo Framework by Labstack
CVE-2026-55677
7.5HIGH
What is CVE-2026-55677?
The Echo web framework experiences an inconsistency between its router and static file handler concerning URL path decoding prior to version 4.15.3 and 5.2.0. The router maintains the raw encoded path, specifically preserving the encoding for %2F, while the StaticDirectoryHandler processes this encoding by converting %2F into a forward slash (/). This discrepancy can be exploited by attackers to circumvent established route-level access controls, enabling unauthorized access to restricted static files. Remediation is available in versions 4.15.3 and 5.2.0.
Affected Version(s)
echo < 4.15.3 < 4.15.3
echo >= 5.0.0, < 5.2.0 < 5.0.0, 5.2.0