Threats affecting pkg:golang/github.com/labstack/echo

CVE-2026-118658 is an open redirect vulnerability in the labstack echo Go web framework. Versions prior to 4.15.2 and 5.1.1 allow an attacker to control the URI scheme used in redirects by manipulating certain forwarded scheme headers. This can lead to redirects to arbitrary URI schemes if an affected redirect middleware is used. The vulnerability requires user interaction and does not affect HTTPS-specific redirect variants. Fixed in versions 4.15.2 and 5.1.1.

Echo, a Go web framework, had a vulnerability in versions prior to 4.16.0 and 5.4.0 where it trusted forwarded scheme headers from any client. This allowed an attacker to bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP or suppress the Strict-Transport-Security header behind a TLS-terminating proxy. The issue is fixed in versions 4.16.0 and 5.4.0.

CVE-2026-118656 is an open redirect vulnerability in the labstack echo Go web framework. Versions prior to 4.16.0 and 5.4.0 improperly validate redirect targets, allowing specially crafted paths with a slash and TAB character to bypass checks. This can cause browsers to normalize the Location header to an attacker-controlled host. The issue is fixed in versions 4.16.0 and 5.4.0.

CVE-2026-118655 is a vulnerability in the labstack echo Go web framework where the middleware.Static component can double decode an already decoded Request.URL.Path. This double decoding allows reconstruction of double-encoded separators before filesystem resolution, potentially enabling access to files under guarded routes if the static middleware is registered globally. The issue affects versions prior to 4.15.3 and between 5.0.0 and before 5.2.0. It is fixed in versions 4.15.3 and 5.2.0.

CVE-2026-118654 is a path traversal vulnerability in the labstack Echo Go web framework. Versions prior to 4.16.0 and between 5.0.0 and before 5.4.0 allow unauthenticated attackers to bypass route-level middleware protections by exploiting static file handlers that normalize dot segments after route matching. This enables unauthorized reading of files intended to be protected. The issue is a regression from an incomplete fix of a previous vulnerability and is resolved in versions 4.16.0 and 5.4.0.

Echo, a Go web framework, has an authentication bypass vulnerability in versions 4.0.0 through 5.0.x where the Context.RealIP method falls back to client-supplied X-Forwarded-For or X-Real-IP headers if Echo.IPExtractor is unset. This allows remote attackers to manipulate forwarded IP addresses to bypass IP-based rate limiting controls. The issue is fixed in Echo version 5.1.0.

A reflected cross-site scripting (XSS) vulnerability exists in the labstack echo Go web framework in versions prior to 4.16.0 and between 5.0.0 and before 5.4.0. The vulnerability arises because Context.JSONP and Context.JSONPBlob methods concatenate an unvalidated callback parameter into a JavaScript response, allowing attacker-controlled input to execute script code. This flaw is fixed in versions 4.16.0 and 5.4.0.

A vulnerability in the Echo Go web framework versions 4.0.0 through 5.3.9 allows an attacker to spoof the client IP address forwarded to upstream services via the X-Real-IP header when the Proxy middleware is used without configuring Echo.IPExtractor. This can undermine IP-based access controls, rate limiting, audit logging, or geographic restrictions relying on the forwarded IP. The issue is fixed in Echo version 5.4.0.

CVE-2026-118650 is a high-severity vulnerability in the labstack Echo Go web framework affecting versions prior to 4.16.0 and 5.4.0. It involves improper handling of URL encoding in the globally mounted middleware.Static instance, where the static handler decodes the URL path differently than the router, leading to inconsistent route protection. This discrepancy can allow an encoded slash to resolve to files under the static root that might otherwise be guarded. The issue is fixed in versions 4.16.0 and 5.4.0.

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.