CVE-2026-55677

NameCVE-2026-55677
DescriptionEcho is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-github-labstack-echo (PTS)bookworm4.2.1-3vulnerable
forky, sid, trixie4.12.0-1vulnerable
golang-github-labstack-echo.v2 (PTS)bullseye2.2.0-2vulnerable
golang-github-labstack-echo.v3 (PTS)bullseye3.3.10-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-github-labstack-echosource(unstable)(unfixed)
golang-github-labstack-echo.v2source(unstable)(unfixed)
golang-github-labstack-echo.v3source(unstable)(unfixed)

Notes

https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq

Search for package or bug name: Reporting problems