Echo EUVD-2026-112459

Requires an application that mounts a static filesystem (via Echo.Static, Echo.StaticFS, Group.Static, Group.StaticFS or the Static middleware / StaticDirectoryHandler) over a path that overlaps files otherwise protected ONLY by route-level middleware, where those protected files are reachable through the static mount after path normalization. The high-severity vector needs no special settings - it works against the DEFAULT router configuration using encoded dot-dot segments such as /public/%2E%2E/admin/secret.txt. A second, lower-severity vector additionally requires the non-default router setting UseEscapedPathForMatching=true. Limiting factors: exploitation is confined to apps that both serve a static mount AND rely on route-level middleware (rather than filesystem separation) to protect the overlapping files; no authentication or user interaction is needed. Mitigation per the advisory is upgrading to v4.16.0 or v5.4.0; interim workarounds are a front reverse proxy that normalizes paths (removing dot segments, merging slashes) or keeping protected files outside the served directory.

Signals point to a real but conditional issue rather than a blanket critical. The CVSS 3.1 base score is 5.9 (medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N: network-reachable and unauthenticated (PR:N), but AC:H reflects that exploitation depends on a specific, non-universal deployment shape - a static filesystem mount that overlaps paths otherwise guarded only by route-level middleware. Impact is confidentiality-only (C:H, I:N, A:N): the flaw discloses protected files, it does not alter them or affect availability. The vuln.today decision label is 'this_month', i.e. a prioritized-but-not-emergency remediation, consistent with the medium CVSS and the conditional trigger. This is NOT a confirmed-exploited emergency: it is not in CISA KEV. EPSS is not provided in the input, so exploitation probability cannot be quantified here - do not treat its absence as 'low'. A public PoC reference exists in the GHSA-3pmx-cf9f-34xr advisory (reproduction requests and focused Go tests), but the input does not mark it as confirmed working exploit code. The genuine aggravating factor is that the high-severity variant works against the default router configuration and needs only encoded dot-dot segments, so any Echo app matching the vulnerable pattern is exposed to unauthenticated attackers.

An Echo application protects /admin/* with route-level middleware (returning 403) but also mounts a static filesystem at / via Echo.StaticFS. An unauthenticated attacker requests /public/%2E%2E/admin/secret.txt; the encoded dot-dot passes the separator guard, is unescaped to public/../admin/secret.txt, and path.Clean resolves it to admin/secret.txt, so the static handler serves the protected file (200 OK) while the direct /admin/secret.txt route returns 403. A public PoC reference with reproduction steps and Go tests is included in the GHSA advisory; AC:H applies because the app must have this overlapping static-mount-plus-middleware configuration.