CVE-2026-118655mediumCWE-174

CVE-2026-118655: falha de média gravidade em labstack echo

Echo: Static Middleware Double-Unescape Path Traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar echo+ Monitorar github.com/labstack/echo/v4

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.3%
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
labstack · echo
CVEs relacionadas — labstack echo

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55677HIGHEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesEPSS 0.5%CVE-2026-118264CRITICALEcho: Rejected WebSocket upgrades can bypass Echo route-level access controlsEPSS 0.4%CVE-2026-118653MEDIUMEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEPSS 0.4%CVE-2026-118650HIGHEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2026-25766MEDIUMEcho has a Windows path traversal via backslash in middleware.Static default filesystemEPSS 0.4%