Vulnerability · CVE-2026-118654
Echo static file middleware route protection bypass via encoded dot-dot traversal
Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Echo static file middleware
Last checked Nov 7, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-118654. EPSS is 0.35%. Act only if a listed version of Echo static file middleware is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Echo static file middleware).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.9
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.35%
- Remediation
- Advisory link
- Affected products
- Go github.com/labstack/echo/v4 · Go github.com/labstack/echo/v5 · golang github.com
## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as and before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as passes the encoded-separator guard, is unescaped to , then resolves it to . If is protected by middleware but the static filesystem is mounted at , the protected file is returned through the public static route. A second bypass exists when . In that mode, the router normalizes encoded separators before the static handler checks the wildcard. The handler receives a decoded wildcard with no characters, so the encoded-separator guard does not run on the original encoded path. ## Impact An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. The high-severity variant works with the default router configuration and requires only encoded dot-dot path segments. The direct protected route returns 403, while the public static route returns the protected file content. The variant is lower severity because it requires a non-default router configuration. ## Affected versions Tested vulnerable: - v5.2.0 - Current at No patched version is currently known. ## Policy and version checks GitHub Private Vulnerability Reporting is enabled for . The repository has a root and accepts security reports through GitHub Security Advisories. The vulnerable code was revalidated on both current and the latest release tag: - Current : - Latest release: , published June 14 2026 - Package: The same focused Go tests pass on the checked out / commit, proving the bypass remains present in the latest released version and latest main branch at the time of reporting. ## Reproduction The following application shape reproduces the high-seve
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/labstack/echo/v40 → 4.16.0
- Go github.com/labstack/echo/v50 → 5.4.0
- golang github.comversion unspecified
How to fix CVE-2026-118654
Upgrade
CVE-2026-118654 lists a fix boundary at 4.16.0. Compare the installed build with that boundary before you change production.
Version check
Fixed in 4.16.0 · 1 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-118654. EPSS is 0.35%. Act only if a listed version of Echo static file middleware is installed.
Which versions are affected?
Compare what you have installed with 0 → 4.16.0, 0 → 5.4.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-22: Path Traversal. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitHub Advisory Database
Detected
## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as and before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as passes the encoded-separator guard, is unescaped to , then resolves it to . I
Oct 28, 2026 · GitHub Advisory Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0; github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · GitHub Advisory Database
Fix available
github.com/labstack/echo/v5 fixed in 5.4.0
Oct 28, 2026 · GitHub Advisory Database
Fix available
github.com/labstack/echo/v4 fixed in 4.16.0
Oct 28, 2026 · GitHub Advisory Database
Updated
## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as and before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as passes the encoded-separator guard, is unescaped to , then resolves it to . I
Sources
- CVE.orgVulnerability recordCVE-2026-118654
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-118654
30-day exploitation probability 0.35%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-3pmx-cf9f-34xr
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-118654
Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as %2F and %5C before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as /public/%2E%2E/admin/secret.txt passes the encoded-separator guard, is unescaped
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-3pmx-cf9f-34xr
Echo static file middleware route protection bypass via encoded dot-dot traversal
osv.dev - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-3pmx-cf9f-34xr
Echo static file middleware route protection bypass via encoded dot-dot traversal
osv.dev
References
Freshness
Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 7, 2026
- Go Vulnerability DatabaseOct 31, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026
- GitHub Advisory DatabaseOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 29, 2026