HIGH 7.5 GitHub
CVE-2026-55677
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
### Summary
Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving `%2F` as-is), while `StaticDirectoryHandler` unescapes `%2F` to `/` before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.
### Details
**Root cause 1 — `router.go` lines 798-802:**
The router uses `req.URL.RawPath` for route matching when `useEscapedPathForRouting
Affected Products
- go/github.com/labstack/echo/v5 < 5.2.0
- go/github.com/labstack/echo/v4 < 4.15.3
- go/github.com/labstack/echo <= 3.3.10
References
- https://github.com/advisories/GHSA-vfp3-v2gw-7wfq
- https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
- https://nvd.nist.gov/vuln/detail/CVE-2026-55677
- https://github.com/labstack/echo/pull/3009
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-25 via GitHub. Affected: go/github.com/labstack/echo/v5 < 5.2.0, go/github.com/labstack/echo/v4 < 4.15.3, go/github.com/labstack/echo <= 3.3.10.
vulnfeed aggregates 11954 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.