DEBIAN-CVE-2026-118655: Medium severity debian/golang-github-labstack-echo vulnerability

Published Oct 28, 2026

Updated

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.

Affected Software

3 affected components

debian/golang-github-labstack-echo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 4.15.3
Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 5.2.0

Event History

Oct 28, 2026

CVE Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using Echo middleware.Static versions before 4.15.3 or 5.2.0 are affected when the static middleware is registered globally and guarded routes are present. The issue can allow access to a file beneath a guarded route.

What does an attacker need to exploit it?

The attacker can act remotely without privileges or user interaction, but exploitation has high attack complexity. They must craft a request using double-encoded path separators so that a second URL-path decode reconstructs separators before filesystem resolution.

Are default configurations affected?

The issue is specifically described for applications that register middleware.Static globally. The provided information does not establish whether this is Echo's default configuration.

What versions contain the fix?

Upgrade to Echo 4.15.3 or 5.2.0, depending on the major version your application uses. Versions earlier than those releases are affected.

DEBIAN-CVE-2026-118655: Medium severity debian/golang-github-labstack-echo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default configurations affected?

What versions contain the fix?