EUVD-2026-39800
GHSA-vfp3-v2gw-7wfq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Echo app serving static files
-
DeliveryCraft URL with %2F encoded slash
-
ExploitRouter skips access-control middleware
-
ExecutionStatic handler decodes path and resolves file
-
ImpactRead unauthorized static file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Echo application (1) serves files using StaticDirectoryHandler and (2) enforces access controls via route-level middleware on those static paths - this is the exact precondition implied by the advisory's router/handler decoding mismatch. The attack uses a percent-encoded slash (%2F) in the request URL so the router matches the raw encoded form (bypassing the guard) while the static handler decodes it to resolve the file. No authentication is required (PR:N), no user interaction is needed (UI:N), and it is exploitable remotely over the network (AV:N) against vulnerable versions. The limiting factor is configuration: applications that do not use StaticDirectoryHandler, or that do not depend on route middleware to protect served files, are not realistically exploitable despite the High CVSS. |
| Impact | Signals are moderate and internally consistent: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 (High) with network reach, low complexity, no privileges and no user interaction, but impact is confined to confidentiality (C:H, I:N, A:N) - no integrity or availability loss. No EPSS score, KEV status, SSVC decision, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified from the data given. The practical risk is gated by a real-world precondition the raw CVSS does not capture: the target must actually use StaticDirectoryHandler AND rely on Echo route-level middleware to protect those static paths. Where that pattern exists, exploitation is trivial and unauthenticated; where static files are not access-controlled, the bug has little security impact. Treat as a meaningful priority for Echo apps serving authorization-gated static content, lower for others. |
| Exploit ScenarioDerived | An Echo application protects a directory of sensitive static files (e.g., /private/) with route middleware while serving them via StaticDirectoryHandler. An unauthenticated attacker requests a URL using %2F in place of the slash so the router's access-control route fails to match, but the static handler decodes it and returns the protected file. No public POC is referenced in the input, and the low-complexity network vector means the request can be sent with any HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Path-based access control bypass in the LabStack Echo Go web framework (versions prior to 4.15.3 and 5.2.0) lets remote attackers retrieve protected static files without authorization. The flaw stems from the router matching routes on the raw encoded path (keeping %2F literal) while StaticDirectoryHandler decodes %2F to '/' before filesystem resolution, so a crafted URL slips past route-level guards. There is no public exploit identified at time of analysis and no CISA KEV listing; CVSS is 7.5 (confidentiality-only).
RemediationAI
Vendor-released patch: upgrade to Echo 4.15.3 on the 4.x branch or 5.2.0 on the 5.x branch, which align path decoding between the router and StaticDirectoryHandler; see the advisory at https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq. If immediate upgrade is not possible, reduce exposure by not relying on Echo route middleware to protect files served via StaticDirectoryHandler - instead enforce authorization inside the static handler or move sensitive files out of the served directory; you can also normalize and reject requests containing encoded slashes (%2F, %2f) at a reverse proxy or WAF before they reach Echo, accepting that this may break legitimate URLs that intentionally encode slashes. Avoid co-locating access-controlled assets and public static assets under the same StaticDirectoryHandler root until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Echo is a high-performance HTTP router/framework for Go. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) manifesting as a parser-differential: the routing layer and the static file handler disagree on when to URL-decode the percent-encoded slash (%2F). Because the router evaluates the encoded form, a route guard registered to protect a path prefix never fires, yet StaticDirectoryHandler later normalizes %2F into a real directory separator and resolves the file on disk. The affected component is identified by CPE cpe:2.3:a:labstack:echo (all versions before the fixes). This is a classic encode/decode normalization mismatch rather than a memory-safety bug, so impact is unauthorized read access rather than code execution.
Know when Echo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated request with an encoded slash needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact is unauthorized file reads only, so C:H but I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Executive ViewAI
LabStack Echo Go web framework versions prior to 4.15.3 and 5.2.0 contain a path-based access control bypass allowing unauthorized access to protected static files through crafted URLs. While no public exploit is currently identified, the vulnerability exposes sensitive application assets to potential unauthorized disclosure. Organizations running affected Echo versions must immediately inventory deployments and implement interim safeguards until patches become available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy Web Application Firewall rules to block %2F-encoded path segments in static file requests; (2) Relocate protected static assets outside the webroot and serve via dedicated authenticated endpoint handlers; (3) Enforce OS-level filesystem permissions to restrict the web application process access to sensitive directories; (4) Implement request rate limiting on static file endpoints to detect and block reconnaissance activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. Rated cr
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to th
Unauthenticated remote file read in Echo web framework versions 5.0.0-5.0.2 on Windows allows attackers to traverse outs
An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticate
Sensitive notification data is exposed to authenticated but unauthorized actors through the Echo extension's API layer i
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB