UBUNTU-CVE-2026-118655: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.15.3 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.2.0
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Echo middleware.Static are exposed when that middleware is registered globally. The risk is that a request can reach a file under a route that would otherwise be guarded.
What does an attacker need to exploit it?
An attacker can send a specially crafted request containing double-encoded path separators. No privileges or user interaction are required, although exploitation has high attack complexity.
Which versions contain the fix?
The issue is fixed in Echo 4.15.3 and 5.2.0. Versions prior to those releases are affected.