Vulnerability · CVE-2026-118650
Echo's middleware.Static: -encoded path bypasses route/group middleware guarding a statically-served path
Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Echo's middleware.Static: -encoded path
Last checked Nov 7, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-118650. EPSS is 0.40%. Act only if a listed version of Echo's middleware.Static: -encoded path is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Echo's middleware.Static: -encoded path).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High7.5
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.40%
- Remediation
- Advisory link
- Affected products
- Go github.com/labstack/echo/v4 · Go github.com/labstack/echo/v5 · golang github.com
## Summary When is mounted globally ( ) and an application relies on a **route- or group-level middleware guard** to restrict a path that also falls under the served static root, a -encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for / in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the path. In addition, the docstring states the default configuration prevents exactly this bypass, which is inaccurate for the global-mount case. **This is not path traversal:** no file outside the static root is accessed. The served file lives inside the static root; the issue is that access-control expectations set by a route guard are inconsistent between the literal and -encoded forms of the same path. ## Details Root cause — the router and the static handler disagree on how to interpret : - The router matches routes on the **raw, still-encoded** path, so does **not** match a route or group; any middleware attached to that route/group is therefore skipped. - selects its path source in (~L219): with a global mount there is no wildcard route, so it uses , which has already **decoded** ( → ). It then s (~L235) and s (~L259) , serving the file. Net effect: for the literal path the guard runs; for the -encoded path the guard is skipped but the same file is served. Relevant code: - ~L219 ( ), ~L235 ( ), ~L259 ( ) - docstring ( ~L60-67) — claims the default prevents the → guard bypass; this is not true for the global mount. Relationship to prior advisories: - **CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq** (patched 5.2.0): same router-vs-handler mismatch, but fixed for / . The path was not covered — this report is that gap. - **CVE-2026-25766 / GHSA-pgvm-wxw2-hrv9** (patched 5.0.3): a *different* issue (Windows backslash traversal **outside** the root). Referenced only to disambiguate; not the same as this report. ## PoC Environment: , module using the official release ( , no local ). Static root contains a m
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/labstack/echo/v40 → 4.16.0
- Go github.com/labstack/echo/v50 → 5.4.0
- golang github.comversion unspecified
How to fix CVE-2026-118650
Upgrade
CVE-2026-118650 lists a fix boundary at 4.16.0. Compare the installed build with that boundary before you change production.
Version check
Fixed in 4.16.0 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-118650. EPSS is 0.40%. Act only if a listed version of Echo's middleware.Static: -encoded path is installed.
Which versions are affected?
Compare what you have installed with 0 → 4.16.0, 0 → 5.4.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-177; CWE-863: Incorrect Authorization. EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitLab Advisory Database
Detected
When middleware.Static is mounted globally (e.Use(middleware.Static(…))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0; github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0
Oct 28, 2026 · Go Vulnerability Database
Fix available
github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · Go Vulnerability Database
Updated
## Summary When is mounted globally ( ) and an application relies on a **route- or group-level middleware guard** to restrict a path that also falls under the served static root, a -encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for / in CVE-2026-55677 / GHSA-vfp3-v2gw-7wfq, but the fix did not cover the path. In addition, the
Sources
- CVE.orgVulnerability recordCVE-2026-118650
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-118650
30-day exploitation probability 0.40%
first.org - GitLab Advisory DatabasePackage advisoryCVE-2026-118650
When middleware.Static is mounted globally (e.Use(middleware.Static(…))) and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the same encoding/decoding mismatch fixed for StaticFS/StaticDirectoryHandler in CVE-2026-55677 / GHSA-
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-375p-5qhx-8wq4
Echo's middleware.Static: -encoded path bypasses route/group middleware guarding a statically-served path
osv.dev
References
Freshness
Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 7, 2026
- Go Vulnerability DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026