Vulnerability in Labstack Echo
CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
Published .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Labstack Echo — versions < 4.15.3, >= 5.0.0, < 5.2.0
Weakness classification (CWE)
References
- github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
- github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
- github.com/labstack/echo/issues/2599
- github.com/labstack/echo/pull/3006
- github.com/labstack/echo/releases/tag/v4.15.3
- github.com/labstack/echo/releases/tag/v5.2.0
- github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
Frequently asked questions
- What is CVE-2026-118655?
- CVE-2026-118655 is a medium-severity vulnerability in Labstack Echo, classified under CWE-174. CVSS score: 5.9/10. Published 2026-10-28.
- How severe is CVE-2026-118655?
- Medium severity. CVSS v3 base score is 5.9 out of 10.