{"id":"GO-2026-6293","revision":null,"records":[{"revision":"5b3abb4c3d0548e298f99f325088f051","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55677","aliases":[],"title":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.","state":0,"publishedAt":"2026-06-26T16:15:55.633+00:00","modifiedAt":"2026-06-26T16:50:57.019+00:00","affected":[{"ecosystem":"Vendor product","name":"echo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"labstack\",\n                    \"product\": \"echo\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.15.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.0.0, < 5.2.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55677","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55677","identifiers":["CVE-2026-55677"]},"retained":false,"historicalAffected":[]},{"revision":"b06fdd9ae10b4af292cfd9ad6651ca90","observedAt":"2026-11-07T12:33:34.251+00:00","statement":{"source":"euvd","id":"EUVD-2026-39800","aliases":["CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"],"title":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes …","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39800","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 26, 2026, 4:15:55 PM","dateUpdated":"Jun 26, 2026, 4:50:57 PM"},"relatedAdvisories":[{"id":"RHSA-2026:90493","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-42502","CVE-2026-55677","CVE-2026-111943"]},{"id":"RHSA-2026:57541","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-39821","CVE-2026-55677"]},{"id":"RHSA-2026:91958","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42504","CVE-2026-55677","CVE-2026-78667","CVE-2026-78669","CVE-2026-84445","CVE-2026-94440","CVE-2026-97031","CVE-2026-111943"]},{"id":"RHSA-2026:61314","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.2","vulnerabilityIds":["CVE-2026-13676","CVE-2026-27145","CVE-2026-29181","CVE-2026-32281","CVE-2026-32285","CVE-2026-35469","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-41178","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-46600","CVE-2026-55677","CVE-2026-56852","CVE-2026-73643"]},{"id":"RHSA-2026:90363","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-42502","CVE-2026-55677","CVE-2026-111943"]},{"id":"RHSA-2026:61585","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:53530","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-42151","CVE-2026-42154","CVE-2026-42306","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677","CVE-2026-55969","CVE-2026-66801"]},{"id":"RHSA-2026:66432","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-39821","CVE-2026-41178","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:44622","title":"Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-41567","CVE-2026-42151","CVE-2026-42154","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677"]},{"id":"RHSA-2026:69293","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-41178","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:47149","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-33811","CVE-2026-39821","CVE-2026-42151","CVE-2026-42154","CVE-2026-43870","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-53492","CVE-2026-55677"]},{"id":"RHSA-2026:67148","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2025-22866","CVE-2026-32281","CVE-2026-41178","CVE-2026-42499","CVE-2026-42504","CVE-2026-55677"]},{"id":"RHSA-2026:63134","title":"Red Hat Security Advisory: osbuild-composer security update","vulnerabilityIds":["CVE-2026-25681","CVE-2026-27136","CVE-2026-39821","CVE-2026-42502","CVE-2026-55677"]},{"id":"RHSA-2026:52946","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.1 security update","vulnerabilityIds":["CVE-2026-27145","CVE-2026-33376","CVE-2026-33377","CVE-2026-53492","CVE-2026-55677","CVE-2026-55969","CVE-2026-66801"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-39800","identifiers":["EUVD-2026-39800","CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"]},"retained":false,"historicalAffected":[]},{"revision":"7e0bcb1619e84e03a5d1a634d2e3d802","observedAt":"2026-10-27T15:15:14.036+00:00","statement":{"source":"nvd","id":"CVE-2026-55677","aliases":[],"title":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes …","description":"Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.","state":0,"publishedAt":"2026-06-26T17:16:34.203+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55677","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-06-26T17:16:34.203","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-55677","identifiers":["CVE-2026-55677"]},"retained":false,"historicalAffected":[]},{"revision":"b15fb6a0f1e0429ba5210ea31f40bab8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vfp3-v2gw-7wfq","aliases":["CVE-2026-55677","GO-2026-6293"],"title":"Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files","description":"### Summary\n\nEcho's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving `%2F` as-is), while `StaticDirectoryHandler` unescapes `%2F` to `/` before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization.\n\n### Details\n\n**Root cause 1 — `router.go` lines 798-802:**\nThe router uses `req.URL.RawPath` for route matching when `useEscapedPathForRouting` is false (the default). This means `/admin%2Fsecret.txt` is treated as a single path segment and does NOT match the `/admin/*` route pattern.\n\n```go\nif !r.useEscapedPathForRouting && req.URL.RawPath != \"\" {\n    path = req.URL.RawPath\n}\n```\n\n**Root cause 2 — `echo.go` lines 559-568:**\n`StaticDirectoryHandler` calls `url.PathUnescape()` on the path parameter before opening files. This converts `%2F` back to `/`, resolving `admin/secret.txt` on disk.\n\n```go\nif !disablePathUnescaping {\n    tmpPath, err := url.PathUnescape(p)\n    p = tmpPath\n}\nname := filepath.ToSlash(filepath.Clean(strings.TrimPrefix(p, \"/\")))\n```\n\n### PoC (Screenshot)\nSample:\n<img width=\"1291\" height=\"970\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0bc58059-3e6d-4678-ab25-a5c79b006738\" />\n\n403:\n<img width=\"526\" height=\"194\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2f55ffdd-87b2-4a1b-8a13-130ebad0f257\" />\n\nBypass with encoded slash:\n<img width=\"592\" height=\"203\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1191cd39-ae8f-4d7e-8fb1-cb9cf31f484f\" />\n\n### Impact\n\nUnauthorized static file disclosure. Applications that protect route prefixes with authentication middleware while also serving static files from a broader root are vulnerable. An attacker only needs to encode the slash (`/` → `%2F`) in the URL to bypass all route-level protection.\n\nCommon affected pattern:\n```go\nadminGroup := e.Group(\"/admin\", authMiddleware)\ne.StaticFS(\"/\", os.DirFS(\"public\"))\n```","state":0,"publishedAt":"2026-08-25T16:13:29+00:00","modifiedAt":"2026-09-10T03:51:14.7741245+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.2.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.15.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.3.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq","https://nvd.nist.gov/vuln/detail/CVE-2026-55677","https://github.com/labstack/echo/pull/3009","https://github.com/labstack/echo/pull/3011","https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"sourceUrl":"https://github.com/advisories/GHSA-vfp3-v2gw-7wfq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vfp3-v2gw-7wfq","identifiers":["GHSA-vfp3-v2gw-7wfq","CVE-2026-55677","GO-2026-6293"]},"retained":false,"historicalAffected":[]},{"revision":"4cdee8960b394828ab83f277c4e72aae","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6293","aliases":["CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"],"title":"Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5","description":"Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5","state":0,"publishedAt":"2026-08-26T14:57:44+00:00","modifiedAt":"2026-08-26T15:15:13.2155951+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.15.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq","https://nvd.nist.gov/vuln/detail/CVE-2026-55677","https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/pull/3009","https://github.com/labstack/echo/pull/3011","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6293","license":"OSV · upstream source license applies","key":"osv:GO-2026-6293","identifiers":["GO-2026-6293","CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}