data/osv/GO-2026-6293.json

{
  "schema_version": "1.3.1",
  "id": "GO-2026-6293",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2026-55677",
    "GHSA-vfp3-v2gw-7wfq"
  ],
  "summary": "Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5",
  "details": "Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5",
  "affected": [
    {
      "package": {
        "name": "github.com/labstack/echo/v4",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.15.3"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/labstack/echo/v4",
            "symbols": [
              "Echo.Static",
              "Echo.StaticFS",
              "Group.Static",
              "Group.StaticFS",
              "StaticDirectoryHandler"
            ]
          },
          {
            "path": "github.com/labstack/echo/v4/middleware",
            "symbols": [
              "Static",
              "StaticWithConfig"
            ]
          }
        ]
      }
    },
    {
      "package": {
        "name": "github.com/labstack/echo/v5",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.0"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/labstack/echo/v5/middleware",
            "symbols": [
              "AddTrailingSlash",
              "AddTrailingSlashWithConfig",
              "BasicAuth",
              "BasicAuthWithConfig",
              "BodyDump",
              "BodyDumpWithConfig",
              "BodyLimit",
              "BodyLimitWithConfig",
              "CORS",
              "CORSWithConfig",
              "CSRF",
              "CSRFWithConfig",
              "ContextTimeout",
              "ContextTimeoutWithConfig",
              "Decompress",
              "DecompressWithConfig",
              "Gzip",
              "GzipWithConfig",
              "HTTPSNonWWWRedirect",
              "HTTPSNonWWWRedirectWithConfig",
              "HTTPSRedirect",
              "HTTPSRedirectWithConfig",
              "HTTPSWWWRedirect",
              "HTTPSWWWRedirectWithConfig",
              "KeyAuth",
              "KeyAuthWithConfig",
              "MethodOverride",
              "MethodOverrideWithConfig",
              "NonWWWRedirect",
              "NonWWWRedirectWithConfig",
              "Proxy",
              "ProxyWithConfig",
              "RateLimiter",
              "RateLimiterWithConfig",
              "Recover",
              "RecoverWithConfig",
              "RemoveTrailingSlash",
              "RemoveTrailingSlashWithConfig",
              "RequestID",
              "RequestIDWithConfig",
              "Rewrite",
              "RewriteWithConfig",
              "Secure",
              "SecureWithConfig",
              "Static",
              "StaticConfig.ToMiddleware",
              "StaticWithConfig",
              "WWWRedirect",
              "WWWRedirectWithConfig"
            ]
          },
          {
            "path": "github.com/labstack/echo/v5",
            "symbols": [
              "Echo.Static",
              "Echo.StaticFS",
              "Group.Static",
              "Group.StaticFS",
              "StaticDirectoryHandler"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677"
    },
    {
      "type": "FIX",
      "url": "https://github.com/labstack/echo/commit/8d1ae9d3360a71672418856d58753af25f2c3986"
    },
    {
      "type": "FIX",
      "url": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725"
    },
    {
      "type": "FIX",
      "url": "https://github.com/labstack/echo/pull/3009"
    },
    {
      "type": "FIX",
      "url": "https://github.com/labstack/echo/pull/3011"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/releases/tag/v4.15.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/labstack/echo/releases/tag/v5.2.0"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2026-6293",
    "review_status": "UNREVIEWED"
  }
}