HighVulnerabilityCVE-2026-118650updated 28 Oct 2026, 20:17 UTC

Echo web framework: encoded paths can bypass route guards for static files

A web app built with Echo can serve a file that a route-level access rule was meant to block, if the request spells the path with an encoded slash (%2F). The file is still inside the public folder, so nothing outside it is exposed.

Fix availableOfficial, 2 sources

Severity	HighCVSS 7.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesgithub.com/labstack/echo/v5 5.4.0; github.com/labstack/echo/v4 4.16.0 · since 28 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Crafted requestUses %2F in the URL path
2RouterMatches the encoded path, skips route guard
3Static handlerDecodes %2F to / and opens the file
4File servedFile inside static root is returned
ResultGuarded static file is served anyway

What happened

In Echo v4 before 4.16.0 and v5 before 5.4.0, a globally mounted middleware.Static handler decodes %2F to / while the router matches the still-encoded path, so route or group middleware is skipped for the encoded form of a path that the static handler still serves.

Why it is dangerous: Applications that protect parts of a static folder with route or group middleware may expose those files to anyone who uses an encoded slash in the URL. This is not path traversal, but it can leak files meant to be restricted.

Are you affected?

You are affected if you use Echo v4 before 4.16.0 or Echo v5 before 5.4.0 and mount middleware.Static globally with e.Use(...) while relying on route or group middleware to restrict a path that falls under the static root.

Package / product	Affected versions	Fixed in
github.com/labstack/echo/v5 · go	< 5.4.0	5.4.0
github.com/labstack/echo/v4 · go	< 4.16.0	4.16.0

What to do

Update github.com/labstack/echo/v5 to 5.4.0 or later, or github.com/labstack/echo/v4 to 4.16.0 or later
Review routes that use middleware guards on paths under the static root and confirm they are not bypassable with %2F
Until updated, avoid relying on route or group guards to protect files inside a globally mounted static folder

Timeline

28 Oct 2026, 19:54 UTC
Publicly disclosed
28 Oct 2026, 19:54 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 19:54 UTC
Picked up by Zero Radar
28 Oct 2026, 20:17 UTC
NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathGitHub Advisory · 28 Oct 2026, 19:54 UTC
CVE-2026-118650NVD · 28 Oct 2026, 20:17 UTC

Technical details

ID: CVE-2026-118650 · GHSA-375p-5qhx-8wq4
CVSS: 7.5 / 10
Disclosed: 28 Oct 2026, 19:54 UTC
On Zero Radar: 28 Oct 2026, 19:54 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 20:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works