Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55677 · Microsoft / collected KEV context

EUVD-2026-39800

GHSA-vfp3-v2gw-7wfq

GO-2026-6293

cve-program · CVE-2026-55677

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq

euvd · EUVD-2026-39800

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq

nvd · CVE-2026-55677

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq

osv · GHSA-vfp3-v2gw-7wfq

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• https://github.com/labstack/echo/pull/3009
• https://github.com/labstack/echo/pull/3011
• https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
• https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
• https://github.com/labstack/echo
• https://github.com/labstack/echo/releases/tag/v4.15.3
• https://github.com/labstack/echo/releases/tag/v5.2.0

osv · GO-2026-6293

• https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
• https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986
• https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
• https://github.com/labstack/echo/pull/3009
• https://github.com/labstack/echo/pull/3011
• https://github.com/labstack/echo/releases/tag/v4.15.3
• https://github.com/labstack/echo/releases/tag/v5.2.0

• Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes … · Advisory content revised · 1 Nov 2026