Echo static file middleware route protection bypass via encoded dot-dot traversal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.16.0, 5.4.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Echo web framework for Go is affected, specifically its static file serving feature. An unauthenticated attacker can read files that an application meant to protect with route-level middleware by using encoded path traversal through a public static file mount.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- labstack echo
fixed in 4.16.0; From 5.0.0 · fixed in 5.4.0
- github.com/labstack/echo/v5Go
fixed in 5.4.0
- github.com/labstack/echo/v4Go
fixed in 4.16.0