EUVD-2026-39800
GHSA-vfp3-v2gw-7wfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated request with an encoded slash needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact is unauthorized file reads only, so C:H but I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
AnalysisAI
Path-based access control bypass in the LabStack Echo Go web framework (versions prior to 4.15.3 and 5.2.0) lets remote attackers retrieve protected static files without authorization. The flaw stems from the router matching routes on the raw encoded path (keeping %2F literal) while StaticDirectoryHandler decodes %2F to '/' before filesystem resolution, so a crafted URL slips past route-level guards. There is no public exploit identified at time of analysis and no CISA KEV listing; CVSS is 7.5 (confidentiality-only).
Technical ContextAI
Echo is a high-performance HTTP router/framework for Go. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) manifesting as a parser-differential: the routing layer and the static file handler disagree on when to URL-decode the percent-encoded slash (%2F). Because the router evaluates the encoded form, a route guard registered to protect a path prefix never fires, yet StaticDirectoryHandler later normalizes %2F into a real directory separator and resolves the file on disk. The affected component is identified by CPE cpe:2.3:a:labstack:echo (all versions before the fixes). This is a classic encode/decode normalization mismatch rather than a memory-safety bug, so impact is unauthorized read access rather than code execution.
RemediationAI
Vendor-released patch: upgrade to Echo 4.15.3 on the 4.x branch or 5.2.0 on the 5.x branch, which align path decoding between the router and StaticDirectoryHandler; see the advisory at https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq. If immediate upgrade is not possible, reduce exposure by not relying on Echo route middleware to protect files served via StaticDirectoryHandler - instead enforce authorization inside the static handler or move sensitive files out of the served directory; you can also normalize and reject requests containing encoded slashes (%2F, %2f) at a reverse proxy or WAF before they reach Echo, accepting that this may break legitimate URLs that intentionally encode slashes. Avoid co-locating access-controlled assets and public static assets under the same StaticDirectoryHandler root until patched.
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. Rated cr
Unauthenticated remote file read in Echo web framework versions 5.0.0-5.0.2 on Windows allows attackers to traverse outs
An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticate
Sensitive notification data is exposed to authenticated but unauthorized actors through the Echo extension's API layer i
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today