CVE-2026-118655

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118655", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.561Z", "datePublished": "2026-10-28T20:03:56.897Z", "dateUpdated": "2026-10-29T18:29:50.622Z"}, "containers": {"cna": {"title": "Echo: Static Middleware Double-Unescape Path Traversal", "problemTypes": [{"descriptions": [{"cweId": "CWE-174", "lang": "en", "description": "CWE-174: Double Decoding of the Same Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96"}, {"name": "https://github.com/labstack/echo/issues/2599", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/issues/2599"}, {"name": "https://github.com/labstack/echo/pull/3006", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/pull/3006"}, {"name": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6"}, {"name": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725"}, {"name": "https://github.com/labstack/echo/releases/tag/v4.15.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v4.15.3"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.2.0"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 5.0.0, < 5.2.0", "status": "affected"}, {"version": "< 4.15.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:03:56.897Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0."}], "source": {"advisory": "GHSA-xwq5-6cqp-vx96", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T18:29:35.386733Z", "id": "CVE-2026-118655", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:29:50.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118655", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T18:29:35.386733Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T18:29:42.489Z"}}], "cna": {"title": "Echo: Static Middleware Double-Unescape Path Traversal", "source": {"advisory": "GHSA-xwq5-6cqp-vx96", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.2.0"}, {"status": "affected", "version": "< 4.15.3"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96", "name": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/issues/2599", "name": "https://github.com/labstack/echo/issues/2599", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/pull/3006", "name": "https://github.com/labstack/echo/pull/3006", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6", "name": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725", "name": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v4.15.3", "name": "https://github.com/labstack/echo/releases/tag/v4.15.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.2.0", "name": "https://github.com/labstack/echo/releases/tag/v5.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-174", "description": "CWE-174: Double Decoding of the Same Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T20:03:56.897Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118655", "state": "PUBLISHED", "dateUpdated": "2026-10-29T18:29:50.622Z", "dateReserved": "2026-10-28T17:25:37.561Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T20:03:56.897Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.2.0"}, {"status": "affected", "version": "< 4.15.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0."}], "id": "CVE-2026-118655", "lastModified": "2026-10-29T19:17:18.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118655", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T18:29:35.386733Z", "version": "2.0.3"}}]}, "published": "2026-10-28T20:17:22.723", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/issues/2599"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/pull/3006"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v4.15.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-174"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: Echo: Information disclosure via double URL decoding in static middleware", "id": "2563173", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563173"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-41", "details": ["Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.", "A flaw was found in Echo. A remote attacker can access files under guarded routes, leading to unauthorized information disclosure. This issue occurs when the static file middleware is registered globally and decodes request URL paths a second time. By sending requests containing double-encoded path separators, an attacker can bypass path restrictions and retrieve files from the server."], "name": "CVE-2026-118655", "public_date": "2026-10-28T20:03:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118655\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118655\nhttps://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6\nhttps://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725\nhttps://github.com/labstack/echo/issues/2599\nhttps://github.com/labstack/echo/pull/3006\nhttps://github.com/labstack/echo/releases/tag/v4.15.3\nhttps://github.com/labstack/echo/releases/tag/v5.2.0\nhttps://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96"], "statement": "This vulnerability is rated as Moderate because exploitation requires an uncommon application design where static file serving is applied globally across all routes, and the impact is confined to unauthorized file reading under guarded endpoints without enabling system modification or code execution. In Red Hat environments deploying services built with the Echo framework, applications are not exposed if file handlers are scoped to specific prefix paths rather than attached to the root router. Furthermore, directory traversal cannot escape beyond the designated root boundary, restricting potential exposure strictly to protected assets located within that file hierarchy.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.2.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.15.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T21:44:37.438768+00:00", "updated": "2026-11-06T02:45:07.228025+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}