CVE-2026-55677
EUVD-2026-3980026.06.2026, 17:16
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| labstack | echo | 𝑥 < 4.15.3 | CNA |
| labstack | echo | 5.0.0 ≤ 𝑥 < 5.2.0 | CNA |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| golang-github-labstack-echo |
| ||||||||||
| golang-github-labstack-echo.v2 |
| ||||||||||
| golang-github-labstack-echo.v3 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| osbuild-composer |
| ||||||||||
| osbuild-composer-core |
| ||||||||||
| osbuild-composer-dnf-json |
| ||||||||||
| osbuild-composer-worker |
|