{"id":"EUVD-2026-112461","enisaUuid":"ebc115f8-c741-3411-b08f-6e70fc96d7f7","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.","datePublished":"Oct 28, 2026, 8:03:56 PM","dateUpdated":"Oct 29, 2026, 6:29:50 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96\nhttps://github.com/labstack/echo/issues/2599\nhttps://github.com/labstack/echo/pull/3006\nhttps://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6\nhttps://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725\nhttps://github.com/labstack/echo/releases/tag/v4.15.3\nhttps://github.com/labstack/echo/releases/tag/v5.2.0\n","aliases":"CVE-2026-118655\nGHSA-xwq5-6cqp-vx96\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"83c259f0-77c7-3b83-ac51-216347a792d9","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.2.0"},{"id":"98b9da14-b46e-3e97-b5d5-fb766a5a4f7b","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"\u003c 4.15.3"}],"enisaIdVendor":[{"id":"a89698b7-3da8-38c4-9c8e-610038150c91","vendor":{"name":"labstack"}}],"enisaIdVulnerability":[{"id":"1d08997f-984a-3680-996a-ea56ac4c4efd","vulnerability":{"id":"GHSA-xwq5-6cqp-vx96","description":"Echo has a Static Middleware Double-Unescape Path Traversal","datePublished":"Oct 28, 2026, 9:04:39 PM","dateUpdated":"Oct 28, 2026, 9:04:39 PM","baseScore":0.0,"references":"https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96\nhttps://github.com/labstack/echo/issues/2599\nhttps://github.com/labstack/echo/pull/3006\nhttps://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6\nhttps://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725\nhttps://github.com/labstack/echo\nhttps://github.com/labstack/echo/releases/tag/v4.15.3\nhttps://github.com/labstack/echo/releases/tag/v5.2.0\n","enisa_id":"EUVD-2026-112461\n","aliases":"GHSA-xwq5-6cqp-vx96\nCVE-2026-118655\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 11:02:20 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"66b76efa-550d-3ecd-b1d0-eabafb0e8adb","vulnerability":{"id":"CVE-2026-118655","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.","datePublished":"Oct 28, 2026, 8:03:56 PM","dateUpdated":"Oct 29, 2026, 6:29:50 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96\nhttps://github.com/labstack/echo/issues/2599\nhttps://github.com/labstack/echo/pull/3006\nhttps://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6\nhttps://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725\nhttps://github.com/labstack/echo/releases/tag/v4.15.3\nhttps://github.com/labstack/echo/releases/tag/v5.2.0\n","enisa_id":"EUVD-2026-112461\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 31, 2026, 12:01:37 AM","vulnerabilityProduct":[{"id":"79f33beb-8559-3c16-8a42-039526375940","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"\u003c 4.15.3"},{"id":"96dd0be9-93d3-34b9-8dd3-f11b574b5301","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.2.0"}],"vulnerabilityVendor":[{"id":"e10c3a3f-aa7f-3114-9f62-941aebca309f","vendor":{"name":"labstack"}}]}}],"enisaIdAdvisory":[]}