CVE-2026-118654

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0

Description Static file handlers can normalize dot segments after route matching, allowing an unauthenticated attacker to read files intended to be protected by route-level middleware. This occurs when protected files are also reachable through a static filesystem mount after path normalization. The issue stems from an incomplete fix where encoded traversal segments, such as %2E%2E, bypass guards that only check for encoded path separators like %2F and %5C. In these cases, the request is unescaped and resolved via path.Clean, serving the protected file through a public static route. Additionally, when the UseEscapedPathForMatching variable is set to true, the router normalizes encoded separators before the static handler checks the wildcard, bypassing the encoded-separator guard.

Recommendations Update Echo to version 4.16.0 or later. Update Echo to version 5.4.0 or later. As a temporary workaround, place a reverse proxy in front of the application to normalize request paths by removing dot segments and merging slashes. As a temporary workaround, ensure that protected files are stored outside the directory served by the static filesystem mount.