Echo CVE-2026-118655

Exploitable only when Echo's middleware.Static is registered GLOBALLY and a file meant to be protected sits under that Static root behind a separate guarded route; the attacker then supplies a double-encoded separator (e.g. %252F or %2e%2e%2f) that the middleware decodes a second time, reconstructing the path before filesystem resolution. Limiting factors: no authentication is required (PR:N per the vector) and no user interaction (UI:N), but the specific global-registration-plus-guarded-route deployment and the double-encoding requirement give it high attack complexity (AC:H); per the maintainer, reading files outside the configured root could not be reproduced, so impact is bounded to in-root files reachable past the route guard. Upgrading to the fixed versions is the stated remedy, with the only noted workaround being to keep protected files outside the Static middleware's root directory.

Signals point to a real but moderate, config-dependent issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, base 5.9, C:H/I:N/A:N) describes a network-reachable, unauthenticated confidentiality-only flaw whose exploitation is gated by high attack complexity. No EPSS score and no KEV status were supplied, and the vuln.today decision label is 'this_month' (not act_now/emergency), so the aggregate urgency is patch-this-cycle, not immediate. There is no input flag of a confirmed public exploit; however, the fix commit (a9ede66a) ships regression tests that spell out the exact triggering vectors (/..%252fsecret.txt and /%2e%2e%2fsecret.txt), so the mechanism is fully public even if no packaged exploit is listed. A key conflict must be flagged: the GHSA 'Impact' line claims 'arbitrary file read from server filesystem,' but the same advisory's maintainer analysis states that reading files OUTSIDE the configured root could NOT be reproduced, and the confirmed impact was only that a double-encoded slash (%252F) could reach a file UNDER a guarded route when the Static middleware is registered globally - i.e. a route-guard/access-control bypass to in-tree static content, not unbounded filesystem disclosure. This materially lowers real-world impact versus the headline path-traversal framing, and the C:H in the supplied vector is arguably optimistic given the maintainer's narrower reproduction. Net: a genuine access-control bypass worth remediating on a normal patch cadence, with the true blast radius depending on whether sensitive files sit under a globally-registered Static root behind a route guard.

An app registers Echo's middleware.Static globally and relies on a separate route guard (e.g. auth on a group) to protect certain static files. A remote attacker requests a double-encoded path such as GET /..%252fsecret.txt or /%2e%2e%2fsecret.txt; the middleware decodes the already-decoded path a second time, reconstructing the separator before filesystem resolution and reaching a file the guarded route was meant to shield. No packaged exploit is listed in the inputs, but the fix commit's regression tests publicly document the precise vectors, and the high attack complexity reflects the specific global-registration-plus-guarded-route layout required.