CVE-2026-118650

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0

Description A globally mounted middleware.Static instance can interpret an encoded request path differently than the router. This occurs because the router matches the encoded path, whereas the static handler utilizes the decoded URL.Path. This discrepancy allows an encoded slash to resolve to a file under the static root via the global static middleware.

Recommendations Update to version 4.16.0 or later. Update to version 5.4.0 or later.