CVE-2026-118655

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.3 Echo versions prior to 5.2.0

Description The middleware.Static component double-unescapes URL paths. Because Go's net/http already decodes Request.URL.Path, the static middleware unconditionally calling url.PathUnescape() a second time allows double-encoded separators to be reconstructed before filesystem resolution. This can lead to arbitrary file read from the server filesystem or allow access to files under a guarded route when the static middleware is registered globally.

Recommendations Update to version 4.15.3 or later. Update to version 5.2.0 or later. Keep files that require protection outside the root directory of the static middleware.