{"id":"GO-2026-6885","revision":"f55c4fdea9b74252bb6a3ea40f26c7fd","records":[{"revision":"f55c4fdea9b74252bb6a3ea40f26c7fd","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6885","aliases":["CVE-2026-118655","GHSA-xwq5-6cqp-vx96"],"title":"Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo","description":"Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo","state":0,"publishedAt":"2026-11-05T22:54:32+00:00","modifiedAt":"2026-11-05T23:15:16.4700033+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.15.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96","https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6","https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725","https://github.com/labstack/echo/pull/3006","https://github.com/labstack/echo/issues/2599","https://github.com/labstack/echo/releases/tag/v4.15.3","https://github.com/labstack/echo/releases/tag/v5.2.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6885","license":"OSV · upstream source license applies","key":"osv:GO-2026-6885","identifiers":["GO-2026-6885","CVE-2026-118655","GHSA-xwq5-6cqp-vx96"]},"retained":false,"historicalAffected":[]}],"coverage":[]}