CVE-2026-55677

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.3 Echo versions prior to 5.2.0

Description A discrepancy exists between the router and the static file handler regarding URL path decoding. The router matches routes using the raw encoded path, preserving %2F as-is, whereas the StaticDirectoryHandler function unescapes %2F to / before resolving filesystem paths. This inconsistency allows an attacker to bypass route-level access controls to read static files without authorization.

Recommendations Update to version 4.15.3 or later. Update to version 5.2.0 or later.