CVE-2026-118650highCWE-177CWE-863

CVE-2026-118650: high-severity vulnerability in labstack echo

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Published · Updated

Follow this CVE+ Monitor echo+ Monitor github.com/labstack/echo/v4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.4%
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
labstack · echo
Related CVEs — labstack echo

In the same product, most dangerous first.

CVE-2026-55677HIGHEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesEPSS 0.5%CVE-2026-118264CRITICALEcho: Rejected WebSocket upgrades can bypass Echo route-level access controlsEPSS 0.4%CVE-2026-118653MEDIUMEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2026-25766MEDIUMEcho has a Windows path traversal via backslash in middleware.Static default filesystemEPSS 0.4%CVE-2026-118261HIGHEcho: Decompress permits unbounded gzip expansion in v4EPSS 0.4%