CVE-2026-118655: Echo: Static Middleware Double-Unescape Path Traversal
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.15.3 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Echo before 4.15.3 or 5.2.0 are exposed when middleware.Static is registered globally and a guarded route can be reached through static-file resolution.
What does an attacker need to exploit this?
The attacker can send a network request without authentication or user interaction, but must craft a request using double-encoded path separators so that a second decode reconstructs separators before filesystem resolution. The high attack complexity reflects the required request-path conditions.
What should be done if upgrading is not immediately possible?
The provided information identifies upgrading to Echo 4.15.3 or 5.2.0 as the fix. It does not provide a documented temporary mitigation.