GHSA-xwq5-6cqp-vx96

Source

https://github.com/advisories/GHSA-xwq5-6cqp-vx96

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xwq5-6cqp-vx96/GHSA-xwq5-6cqp-vx96.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xwq5-6cqp-vx96

Aliases

CVE-2026-118655

Published

2026-10-28T21:04:39Z

Modified

2026-10-28T21:15:04Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Echo has a Static Middleware Double-Unescape Path Traversal

Details

Summary

Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware.

Vulnerability

The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again:

// BEFORE (vulnerable)
pathUnescape := true

This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt.

Fix

// AFTER (fixed)
pathUnescape := false

The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked.

Impact

Arbitrary file read from server filesystem via percent-encoded path traversal.

References

Patches

Fixed in github.com/labstack/echo/v5 v5.2.0 and github.com/labstack/echo/v4 v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (%252F) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths.

Workarounds

Keep files that need protection outside the Static middleware's root directory.

Database specific

{
    "cwe_ids":  [
        "CWE-174"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-28T21:04:39Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/labstack/echo/v5

Package

Name: github.com/labstack/echo/v5; View open source insights on deps.dev
Purl: pkg:golang/github.com/labstack/echo/v5

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xwq5-6cqp-vx96/GHSA-xwq5-6cqp-vx96.json"

Go / github.com/labstack/echo/v4

Package

Name: github.com/labstack/echo/v4; View open source insights on deps.dev
Purl: pkg:golang/github.com/labstack/echo/v4

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.15.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xwq5-6cqp-vx96/GHSA-xwq5-6cqp-vx96.json"