Echo CVE-2026-118656

Exploitation requires the application to register the AddTrailingSlash or RemoveTrailingSlash middleware WITH a redirect status set (RedirectCode != 0, e.g. http.StatusMovedPermanently); without RedirectCode the middleware rewrites the path internally and is not vulnerable, and a default Echo deployment that does not use these middlewares is unaffected. The attack path must place a surviving control character (a literal TAB, delivered as %09) immediately before the separator pair, e.g. /%09/attacker.example/x/ or /%09%5Cattacker.example/x/; the newline (%0A) variant does NOT work because net/http rewrites CR/LF in header values, and a %09// (three-slash) form fails because it yields an empty authority. The decisive limiting factor is UI:R - the victim must actually click and follow the crafted link in a browser that strips tabs and normalizes backslashes; no authentication is required of the attacker (PR:N). Vulnerable versions are echo/v4 < 4.16.0 and echo/v5 < 5.4.0.

This is a medium-severity open redirect (CVSS 6.1, CWE-601) whose real-world priority is moderate rather than urgent. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms a network-reachable, low-complexity, unauthenticated flaw (PR:N) that nonetheless requires user interaction (UI:R) - the victim must follow the crafted link - which is why the technical impact is capped at Low confidentiality/integrity and the issue is scored Medium, not High. It is NOT in CISA KEV and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month', consistent with important-but-not-emergency handling. A detailed proof-of-concept is attached to the GHSA advisory and the reporter confirms the redirect end-to-end in headless Chromium, so the mechanism is well understood and reproducible, but note the distinction: a working PoC demonstration is not the same as observed in-the-wild exploitation. The key limiting factor that lowers real risk below the raw CVSS number is that exploitation requires a non-default configuration - the AddTrailingSlash or RemoveTrailingSlash middleware must be registered with a RedirectCode set; a default Echo deployment is not affected. EPSS is absent (not an error, simply not provided), so probabilistic exploitation likelihood cannot be quantified from this data.

An attacker crafts a link on the trusted victim domain such as https://victim.example/%09/attacker.example/x/ and sends it via phishing or embeds it in an OAuth/SSO flow. When the victim clicks it, the vulnerable trailing-slash middleware emits a Location header containing a literal TAB before the separator pair, which the browser strips and normalizes, silently redirecting the user to attacker.example while the trusted domain appeared in the original link. A self-contained PoC Go module is attached to the GHSA advisory and the reporter confirmed the cross-origin redirect in a headless browser.