Echo · Echo · CVE-2026-55677
**Name of the Vulnerable Software and Affected Versions**
Echo versions prior to 4.15.3
Echo versions prior to 5.2.0
**Description**
A discrepancy exists between the router and the static file handler regarding URL path decoding. The router matches routes using the raw encoded path, preserving `%2F` as-is, whereas the `StaticDirectoryHandler` function unescapes `%2F` to `/` before resolving filesystem paths. This inconsistency allows an attacker to bypass route-level access controls to read static files without authorization.
**Recommendations**
Update to version 4.15.3 or later.
Update to version 5.2.0 or later.