Login Request a demo
Medium severity · published Oct 28, 2026
CVE-2026-118655
Echo: Static Middleware Double-Unescape Path Traversal
New
5.9
CVSS
–
EPSS
No
On KEV
Description
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
echo · labstack
>= 5.0.0, < 5.2.0; < 4.15.3 · source: vendor
Affected product
EC
echo
labstack
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118655
x_refsource_CONFIRM
https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
x_refsource_MISC
https://github.com/labstack/echo/issues/2599
x_refsource_MISC
https://github.com/labstack/echo/pull/3006
x_refsource_MISC
https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
x_refsource_MISC
https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
x_refsource_MISC
https://github.com/labstack/echo/releases/tag/v4.15.3
More from echo
9.6
CVE-2022-40083
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component
9.1
CVE-2026-118264
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
8.2
CVE-2026-118262
Echo: WebSocket proxy can retain connections and handlers after client disconnect
8.2
CVE-2026-118261
Echo: Decompress permits unbounded gzip expansion in v4
8.2
CVE-2026-118260
Echo: BodyDump captures request and response bodies without size limits in v4