CVE-2026-118654: V5 · Echo static file middleware route protection bypass via encoded dot-dot traversal

## Summary Echo v5.2.0 contains a bypass of the fix for GHSA-vfp3-v2gw-7wfq. The fix rejects encoded path separators such as `%2F` and `%5C` before static file path unescaping, but two traversal forms still bypass route-level middleware protections for static files. The primary bypass uses encoded dot-dot segments. A request such as `/public/%2E%2E/admin/secret.txt` passes the encoded-separator guard, is unescaped to `public/../admin/secret.txt`, then `path.Clean` resolves it to `admin/secret.txt`. If `/admin/*` is protected by middleware but the static filesystem is mounted at `/`, the protected file is returned through the public static route. A second bypass exists when `UseEscapedPathForMatching=true`. In that mode, the router normalizes encoded separators before the static handler checks the wildcard. The handler receives a decoded wildcard with no `%` characters, so the encoded-separator guard does not run on the original encoded path. ## Impact An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. The high-severity variant works with the default router configuration and requires only encoded dot-dot path segments. The direct protected route returns 403, while the public static route returns the protected file content. The `UseEscapedPathForMatching=true` variant is lower severity because it requires a non-default router configuration. ## Affected versions Tested vulnerable: - `github.com/labstack/echo/v5` v5.2.0 - Current `master` at `5786024ea4d85c01784796e8aa7aac53e007b39b` No patched version is currently known. ## Policy and version checks GitHub Private Vulnerability Reporting is enabled for `labstack/echo`. The repository has a root `SECURITY.md` and accepts security reports through GitHub Security Advisories. The vulnerable code was revalidated on both current `master` and the latest release tag: - Current `master`: `5786024ea4d85c01784796e8aa7aac53e007b39b` - Latest release: `v5.2.0`, published June 14 2026 - Package: `github.com/labstack/echo/v5` The same focused Go tests pass on the checked out `v5.2.0` / `master` commit, proving the bypass remains present in the latest released version and latest main branch at the time of reporting. ## Reproduction The following application shape reproduces the high-severity bypass: ```go e := echo.New() g := e.Group("/admin", func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { return echo.NewHTTPError(http.StatusForbidden) } }) g.GET("/*", handler) e.StaticFS("/", fsysWithAdminSecret) ``` Control request: ```http GET /admin/secret.txt ``` Observed result: ```text 403 Forbidden ``` Bypass request: ```http GET /public/%2E%2E/admin/secret.txt ``` Observed result: ```text 200 OK TOP-SECRET ``` For the non-default router variant: ```go e := echo.New() e.router = echo.NewRouter(echo.RouterConfig{ UseEscapedPathForMatching: true, }) g := e.Group("/admin", authMiddlewareReturning403) g.GET("/*", handler) e.StaticFS("/", fsysWithAdminSecret) ``` Bypass request: ```http GET /public%2F..%2Fadmin%2Fsecret.txt ``` Observed result: ```text 200 OK TOP-SECRET ``` ## Proof of concept evidence I added focused tests against the current Echo codebase. The tests exercise both `StaticDirectoryHandler` and the static middleware path. Command: ```bash go test -run TestHostile -v ./... ``` Observed result: ```text === RUN TestHostile_StaticDirectoryHandler_EncodedSeparatorsBlocked --- PASS: TestHostile_StaticDirectoryHandler_EncodedSeparatorsBlocked (0.00s) === RUN TestHostile_StaticDirectoryHandler_EncodedDotDotBypass --- PASS: TestHostile_StaticDirectoryHandler_EncodedDotDotBypass (0.00s) === RUN TestHostile_UseEscapedPathForMatching_Bypass --- PASS: TestHostile_UseEscapedPathForMatching_Bypass (0.00s) PASS ok github.com/labstack/echo/v5 0.013s === RUN TestHostile_StaticMiddleware_EncodedSeparatorsBlocked --- PASS: TestHostile_StaticMiddleware_EncodedSeparatorsBlocked (0.01s) === RUN TestHostile_StaticMiddleware_EncodedDotDotBypass --- PASS: TestHostile_StaticMiddleware_EncodedDotDotBypass (0.00s) === RUN TestHostile_StaticMiddleware_DisablePathUnescaping --- PASS: TestHostile_StaticMiddleware_DisablePathUnescaping (0.00s) PASS ok github.com/labstack/echo/v5/middleware 0.012s ``` The control tests also confirm that the new fix blocks encoded separators such as `%2F`, `%5C`, double-encoded slash values, null bytes, and overlong slash encodings. ## Root cause The fix for GHSA-vfp3 uses a denylist-style guard that checks for encoded path separators before unescaping the static wildcard. This blocks `%2F` and `%5C`, but does not block encoded traversal segments such as `%2E%2E`. The vulnerable flow is: 1. The static route wildcard accepts `public/%2E%2E/admin/secret.txt`. 2. The encoded-separator guard sees no `%2F`

• github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr (opens in a new tab)
• github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (opens in a new tab)
• github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (opens in a new tab)
• github.com/labstack/echo (opens in a new tab)
• github.com/labstack/echo/releases/tag/v4.16.0 (opens in a new tab)
• github.com/labstack/echo/releases/tag/v5.4.0 (opens in a new tab)

• CVE-2026-118657: Echo · HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersMediumVulnerability2026-10-28
• CVE-2026-118655: V5 · Echo has a Static Middleware Double-Unescape Path TraversalMediumVulnerability2026-10-28
• CVE-2026-118656: V5 · Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURIMediumVulnerability2026-10-28
• WWWRedirect/NonWWWRedirect Middlewares · V5: Echo has Arbitrary Scheme InjectionMediumVulnerability2026-10-28
• github.com/labstack/echo/v5 · Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathHighVulnerability2026-10-28