{"id":"EUVD-2026-39800","revision":"56ce311ba21d4db98fc7bef511eaec50","records":[{"revision":"56ce311ba21d4db98fc7bef511eaec50","observedAt":"2026-11-01T10:12:39.598+00:00","statement":{"source":"euvd","id":"EUVD-2026-39800","aliases":["CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"],"title":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes …","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39800","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 4:15:55 PM","dateUpdated":"Jun 26, 2026, 4:50:57 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90493","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-42502","CVE-2026-55677","CVE-2026-111943"]},{"id":"RHSA-2026:57541","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-39821","CVE-2026-55677"]},{"id":"RHSA-2026:91958","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42504","CVE-2026-55677","CVE-2026-78667","CVE-2026-78669","CVE-2026-84445","CVE-2026-94440","CVE-2026-97031","CVE-2026-111943"]},{"id":"RHSA-2026:61314","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.2","vulnerabilityIds":["CVE-2026-13676","CVE-2026-27145","CVE-2026-29181","CVE-2026-32281","CVE-2026-32285","CVE-2026-35469","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-41178","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-46600","CVE-2026-55677","CVE-2026-56852","CVE-2026-73643"]},{"id":"RHSA-2026:90363","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-42502","CVE-2026-55677","CVE-2026-111943"]},{"id":"RHSA-2026:61585","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:53530","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-42151","CVE-2026-42154","CVE-2026-42306","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677","CVE-2026-55969","CVE-2026-66801"]},{"id":"RHSA-2026:66432","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-39821","CVE-2026-41178","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:44622","title":"Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-41567","CVE-2026-42151","CVE-2026-42154","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677"]},{"id":"RHSA-2026:69293","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-41178","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:47149","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-42151","CVE-2026-42154","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677"]},{"id":"RHSA-2026:67148","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-22866","CVE-2026-32281","CVE-2026-41178","CVE-2026-42499","CVE-2026-42504","CVE-2026-55677"]},{"id":"RHSA-2026:63134","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-39821","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:52946","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.1 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-53492","CVE-2026-55677","CVE-2026-55969","CVE-2026-66801"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39800","identifiers":["EUVD-2026-39800","CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}