Description
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Published: 2026-10-28
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xwq5-6cqp-vx96 Echo has a Static Middleware Double-Unescape Path Traversal
History

Wed, 28 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Title Echo: Static Middleware Double-Unescape Path Traversal
Weaknesses CWE-174
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-28T20:03:56.897Z

Reserved: 2026-10-28T17:25:37.561Z

Link: CVE-2026-118655

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T20:17:22.723

Modified: 2026-10-28T20:17:22.723

Link: CVE-2026-118655

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-174

    Double Decoding of the Same Data