Echo has a Static Middleware Double-Unescape Path Traversal
Exact source revision recorded 28 Oct 2026 21:56:58 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-xwq5-6cqp-vx96
Published## Summary Commit a9ede66a (PR #3006, issue #2599) silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. ## Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally called url.PathUnescape() again: ```go // BEFORE (vulnerable) pathUnescape := true ``` This reassembled path traversal sequences from double-encoded input. An attacker could send GET /%2e%2e%2fsecret.txt or /..%252fsecret.txt and the double-unescape would produce ../secret.txt. ## Fix ```go // AFTER (fixed) pathUnescape := false ``` The commit's test TestStatic_percentEncodedTraversalIsBlocked explicitly verifies traversal vectors are blocked. ## Impact Arbitrary file read from server filesystem via percent-encoded path traversal. ## References - Fix: https://github.com/labstack/echo/commit/a9ede66a - Issue: https://github.com/labstack/echo/issues/2599 - PR: https://github.com/labstack/echo/pull/3006 ## Patches Fixed in `github.com/labstack/echo/v5` v5.2.0 and `github.com/labstack/echo/v4` v4.15.3, where the Static middleware stopped unescaping an already decoded path. Maintainer analysis: reading files outside the configured root could not be reproduced; the confirmed impact was that a double-encoded slash (`%252F`) could reach a file under a guarded route when the Static middleware is registered globally. Upgrade to v5.4.0 / v4.16.0 or later, which also includes related fixes for encoded and dot-segment paths. ## Workarounds Keep files that need protection outside the Static middleware's root directory.
- Source published
- 28 Oct 2026 21:04:39 UTC
- Source modified
- 28 Oct 2026 21:15:04 UTC
- Observed here
- 28 Oct 2026 21:56:58 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.
CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Publisher rating · MODERATE