UBUNTU-CVE-2026-118654: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.16.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.0
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected Echo versions are exposed only when a file intended to be protected by route-level middleware is also reachable through a public static filesystem mount after dot-segment path normalization.
What does an attacker need to exploit the vulnerability?
The attacker does not need authentication or user interaction. Exploitation requires finding a protected file that can also be reached through a public static route using a path whose dot segments are normalized after route matching.
Are confidentiality, integrity, or availability affected?
The issue can expose protected files to unauthenticated reading, so confidentiality is affected. The provided severity vector indicates no integrity or availability impact.
Which versions contain the fix?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions before those releases are affected under the relevant route and static-mount configuration.