In labstack Echo versions before 4.15.3 and 5.2.0, the router matches routes using the raw encoded URL path, preserving encoded slashes (%2F), while the StaticDirectoryHandler unescapes %2F to a slash before resolving filesystem paths. This discrepancy enables an attacker to bypass route-level access controls and access static files without authorization, constituting a path traversal vulnerability (CWE-22). The vulnerability is addressed by synchronizing path decoding behavior in Echo versions 4.15.3 and 5.2.0.

An attacker can exploit this vulnerability to read static files on the server without proper authorization, potentially exposing sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

This vulnerability is fixed in labstack Echo versions 4.15.3 and 5.2.0. Users should upgrade to at least these versions to remediate the issue. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix is included in these versions.