CVE-2026-118655

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.

• CWE-174

• https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6
• https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725
• https://github.com/labstack/echo/issues/2599
• https://github.com/labstack/echo/pull/3006
• https://github.com/labstack/echo/releases/tag/v4.15.3
• https://github.com/labstack/echo/releases/tag/v5.2.0
• https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118649n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-…8.3
• CVE-2026-118650Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a glo…7.5
• CVE-2026-118651Echo is a Go web framework. From 4.0.0 until 5.4.0, the Prox…5.3
• CVE-2026-118652Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Conte…6.1
• CVE-2026-118653Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.…5.3
• CVE-2026-118654Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.9
• CVE-2026-118656Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanit…6.1
• CVE-2026-118657Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Conte…5.9
• CVE-2026-118658Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Conte…4.7
• CVE-2026-118659Happy DOM is a JavaScript implementation of a web browser wi…7.5
• CVE-2026-11866The Appointment Booking Plugin WordPress plugin before 5.6.…5.4
• CVE-2026-118660Happy DOM is a JavaScript implementation of a web browser wi…8.6