| Name | CVE-2026-55677 |
| Description | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1141444 |
Vulnerable and fixed packages
The table below lists information on source packages.
The information below is based on the following data on fixed versions.
Notes
[trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
[bookworm] - golang-github-labstack-echo <postponed> (Minor issue; encoded-slash %2F static route bypass)
[bullseye] - golang-github-labstack-echo.v3 <postponed> (Minor issue; limited/case-by-case golang support, no upstream v3 fix)
[bullseye] - golang-github-labstack-echo.v2 <not-affected> (static handler does no url.PathUnescape; encoded-separator path absent)
https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq