Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.4.0, 4.16.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Echo, a Go web framework, is affected when its static file middleware is mounted globally. Under that configuration, an encoded path can potentially reach files in the static directory while bypassing access controls that were meant to protect the same path.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- labstack echo
From 5.0.0 · fixed in 5.4.0; fixed in 4.16.0
- github.com/labstack/echo/v5Go
fixed in 5.4.0
- github.com/labstack/echo/v4Go
fixed in 4.16.0