UBUNTU-CVE-2026-118650: High severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Frequently Asked Questions
Which deployments are exposed to this path-handling issue?
Deployments using Echo before 4.16.0 or 5.4.0 with a middleware.Static instance mounted globally are affected. The issue concerns differences between router matching of encoded paths and static-file handling of decoded URL paths.
What does an attacker need to exploit it?
The reported vector is network-accessible and requires no privileges or user interaction. An attacker can send a request containing an encoded slash that is interpreted differently by the router and the global static middleware.
What is the potential impact?
The demonstrated behavior can resolve a file under the configured static root through globally mounted static middleware. The advisory assigns high confidentiality impact, while integrity and availability impact are listed as none.
How can this be remediated?
Upgrade Echo to version 4.16.0 or 5.4.0, depending on the major version in use. The supplied data does not specify a workaround for systems that cannot yet upgrade.