CVE-2026-118655 in Echo
Summary
by MITRE • 10/28/2026
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Echo web framework, widely utilized for building RESTful APIs and microservices in Go, contains a critical path traversal vulnerability within its Static file serving middleware prior to versions 4.15.3 and 5.2.0. This flaw stems from an improper handling of URL-encoded characters during the request processing lifecycle. Specifically, when the static middleware is registered globally or applied to routes that serve files directly from the filesystem, it fails to properly sanitize input paths before resolving them against the underlying file system structure. The core technical issue lies in the double decoding behavior where a Request.URL.Path that has already been decoded by Go's standard library net/http package undergoes an additional round of URL decoding within the middleware logic. This redundant decoding operation allows attackers to reconstruct path separators such as forward slashes or backslashes from their percent-encoded equivalents, effectively bypassing intended directory restrictions and enabling access to files located outside the designated static root directory.
From a technical perspective, this vulnerability is classified under CWE-20 Improper Input Validation and CWE-78 OS Command Injection via Path Traversal mechanisms when it leads to unauthorized file reads or potentially remote code execution if combined with other vectors like symbolic links or log injection. The attack vector aligns with the ATT&CK technique T1083 File and Directory Discovery, as well as T1564 Hidden Files and Directories, because it allows an adversary to enumerate and access sensitive files that are not intended for public consumption. By crafting a request with double-encoded path segments, such as %252e%252e%252f which decodes first to ..%2f and then to ../, the attacker can traverse up directory levels from the static root. This is particularly dangerous in configurations where sensitive configuration files, source code backups, or environment variable dumps are stored within or adjacent to the web-accessible directories but protected by application-level route guards that do not account for this encoding bypass.
The operational impact of this vulnerability varies based on the deployment context and file permissions. In a typical production environment, an attacker could read sensitive internal files such as .env files containing database credentials, API keys, or secret tokens stored in the project root or parent directories. If the web server runs with elevated privileges or if specific symlinks are present pointing to critical system paths like /etc/passwd or Windows registry hives via mapped drives, the impact escalates significantly. Furthermore, depending on how the application handles these retrieved files, such as echoing them back in responses without proper content type restrictions, it could facilitate further attacks including cross-site scripting if user-controllable data is served from untrusted locations. The vulnerability remains exploitable remotely over HTTP or HTTPS with no authentication required unless additional access controls are implemented at a layer above the static middleware that also fail to sanitize inputs correctly.
Mitigation strategies primarily involve upgrading the Echo framework to version 4.15.3 or later, where this double-decoding flaw has been patched by ensuring that path components are validated against traversal sequences after all decoding operations have completed. For organizations unable to upgrade immediately due to dependency constraints, a temporary workaround involves implementing custom middleware that explicitly sanitizes the request URL path before it reaches the static handler. This custom layer should normalize paths and reject any requests containing encoded characters that resolve to parent directory references or null bytes. Additionally, developers should ensure that the static file server is configured with strict root directories using Go's http.Dir interface correctly and avoid registering global middleware for static files unless absolutely necessary. Regular security audits focusing on input validation patterns in web frameworks are recommended to detect similar encoding bypass vulnerabilities across other components of the application stack.