{"id":"GO-2026-6293","revision":"4cdee8960b394828ab83f277c4e72aae","records":[{"revision":"4cdee8960b394828ab83f277c4e72aae","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6293","aliases":["CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"],"title":"Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5","description":"Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5","state":0,"publishedAt":"2026-08-26T14:57:44+00:00","modifiedAt":"2026-08-26T15:15:13.2155951+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.15.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq","https://nvd.nist.gov/vuln/detail/CVE-2026-55677","https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/pull/3009","https://github.com/labstack/echo/pull/3011","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6293","license":"OSV · upstream source license applies","key":"osv:GO-2026-6293","identifiers":["GO-2026-6293","CVE-2026-55677","GHSA-vfp3-v2gw-7wfq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}